GNU bug report logs - #9113
24.0.50; auth-sources: .authinfo versus .authinfo.gpg

Previous Next

Full log

Message #32 received at 9113 <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> unixuser.org>
To: Achim Gratz <Stromeko <at> nexgo.de>
Cc: 9113 <at> debbugs.gnu.org, Lars Ingebrigtsen <larsi <at> gnus.org>,
	Roland Winkler <winkler <at> gnu.org>
Subject: Re: bug#9113: 24.0.50;
	auth-sources: .authinfo versus .authinfo.gpg, bug#9113: 24.0.50;
	auth-sources: .authinfo versus .authinfo.gpg, bug#9113: 24.0.50;
	auth-sources: .authinfo versus .authinfo.gpg
Date: Fri, 27 Jan 2012 10:47:32 +0900

Ted Zlatanov <tzz <at> lifelogs.com> writes:

>>>> 2) use unencrypted authinfo with encrypted password tokens, which
>>>> looks like this:
>>> 
>>>> machine supertest password
>>>> gpg:jA0EAwMC2tUEaZgM7A5gyWM/owySdCOS/cjoFCuf8LI1d1kYX7z6cjsNkakM04u1geh/iesqyH3XQFI+SEVLb/oEC/EoQ0LIgRRoBiLyu9XZWN1ytY7MQxpPZniFz13oGV4/Dwl8yrP3Hba5LfQpHy2FZRM=
>
> It works fairly well but it's hacky, and can't be shared with other
> programs.  I'd like to implement it with libnettle at least, so it
> doesn't depend on the external gpg utility.  But yes, we could do this
> one and it would work on all platforms with libnettle.

I remember there were a couple of concerns:

(1) it also doesn't work with GnuPG2 at all (have you tested it?)
(2) even with libnettle, you need to implement OpenPGP packet handling
    if you want to keep the data compatibility with GPG (I don't think
    it is a good idea to reinvent another encrypted data format with
    plist as you proposed)

BTW,

>>> IIRC for 23 the default was to keep the password for the current session
>>> and not to store it in any file at all.  I think it's a better default
>>> than writing it in clear in some file, so at least for 24.1 reverting to
>>> the Emacs-23 default is very attractive.
>
> LI> Well, Emacs 23 just made you write the .authinfo file by hand.  Emacs 24
> LI> prompts you for whether you want to store the password or not.  If you
> LI> don't want to, say "n".

Even then, it is combersome for me to type "n" to proceed to the next
step (i.e. accessing smtp, etc).  Firefox allows user to keep browsing
password protected Web pages without answering the question immediately.

How about:

(1) add M-x auth-source-save command to save passwords manually
(2) (message "Type \\[auth-source-save] to save your passwords to file")
    instead of the question

Regards,
-- 
Daiki Ueno

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.