From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ed Green Newsgroups: gmane.emacs.bugs Subject: bug#19991: 24.3; insecure design or else bug: gpg passphrase persists when emacs is closed and re-opened Date: Tue, 03 Mar 2015 12:19:27 -0500 Message-ID: <54F5ED1F.5030701@psu.edu> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1425403229 31982 80.91.229.3 (3 Mar 2015 17:20:29 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 3 Mar 2015 17:20:29 +0000 (UTC) To: 19991@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue Mar 03 18:20:16 2015 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1YSqUO-0005rR-OO for geb-bug-gnu-emacs@m.gmane.org; Tue, 03 Mar 2015 18:20:12 +0100 Original-Received: from localhost ([::1]:40023 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqUN-0003L2-Mt for geb-bug-gnu-emacs@m.gmane.org; Tue, 03 Mar 2015 12:20:11 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:56282) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqUI-0003Fo-Am for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:20:07 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YSqUE-0002qD-TF for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:20:06 -0500 Original-Received: from debbugs.gnu.org ([140.186.70.43]:35583) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqUE-0002pN-Qe for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:20:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1YSqUE-0004r7-DE for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:20:02 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Ed Green Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Tue, 03 Mar 2015 17:20:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 19991 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.142540319918648 (code B ref -1); Tue, 03 Mar 2015 17:20:01 +0000 Original-Received: (at submit) by debbugs.gnu.org; 3 Mar 2015 17:19:59 +0000 Original-Received: from localhost ([127.0.0.1]:34151 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1YSqUA-0004qh-3y for submit@debbugs.gnu.org; Tue, 03 Mar 2015 12:19:58 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:54475) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1YSqU7-0004qT-49 for submit@debbugs.gnu.org; Tue, 03 Mar 2015 12:19:56 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YSqU0-0002hs-Ek for submit@debbugs.gnu.org; Tue, 03 Mar 2015 12:19:49 -0500 Original-Received: from lists.gnu.org ([2001:4830:134:3::11]:48592) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqU0-0002ho-CZ for submit@debbugs.gnu.org; Tue, 03 Mar 2015 12:19:48 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:56177) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqTy-0002gl-TZ for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:19:48 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YSqTv-0002gX-BA for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:19:46 -0500 Original-Received: from tr22g11a.aset.psu.edu ([128.118.146.136]:56128 helo=tr22n11a.aset.psu.edu) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSqTv-0002cW-5P for bug-gnu-emacs@gnu.org; Tue, 03 Mar 2015 12:19:43 -0500 Original-Received: from [192.168.0.15] (c-50-149-28-122.hsd1.pa.comcast.net [50.149.28.122]) (authenticated bits=0) by tr22n11a.aset.psu.edu (8.14.3/8.14.3) with ESMTP id t23HJRTu1855636 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Tue, 3 Mar 2015 12:19:32 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x (barebone) [generic] X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:100022 Archived-At: --text follows this line-- This bug report will be sent to the Bug-GNU-Emacs mailing list and the GNU bug tracker at debbugs.gnu.org. Please check that the From: line contains a valid email address. After a delay of up to one day, you should receive an acknowledgment at that address. Please write in English if possible, as the Emacs maintainers usually do not have translators for other languages. Please describe exactly what actions triggered the bug, and the precise symptoms of the bug. If you can, give a recipe starting from `emacs -Q': --- BUG REPORT BEGINS HERE I opened emacs24 in xubuntu 14.04 with command "emacs&". In dired, I opened a gpg-encrypted file. I was prompted to supply my passphrase, after which the unencrypted text was displayed. I did not click the box labelled "Automatically unlock this key, whenever I'm logged in". Next, I closed emacs by clicking the 'x' in the corner of the window. I opened emacs in a new process with "emacs&". Again in dired, I opened a different gpg-encrypted file. The unencrypted text was immediately displayed, without my being prompted for a passphrase. Only after I re-booted the computer, was I again required to provide a passphrase in order to display decrypted text of an encrypted file. (I did so again, and repeated the test just described, prior to writing this message.) There is no notification of this behavior of the program, either on screen or in any documentation that I have been able to find. Users reasonably believe that, after they close emacs, data (including a passphrase) entered in a session will be lost. But even a user who is sufficiently prudent to close emacs after reading an encrypted file will unwittingly expose all of his/her encrypted files to being read by someone else who is able to open emacs (even remotely, I guess) on the computer, until the next time that it is re-booted. I've been using emacs for a long time to read encrypted files, without realising until now that they were being potentially exposed in that way. It seems preferable that this behavior should be changed, so that a passphrase supplied during an emacs session will be over-written in computer memory when the emacs process is terminated--and especially so that the passphrase is not automatically used when emacs is subsequently run---unless possibly the user has deliberately elected to make the passphrase to persist. (I wouldn't personally recommend that users be offered that risky option.) At the very least, if the current behavior is retained, then a clear, prominent warning about it should be given. By the way, would it also be desirable to over-write computer memory assigned to emacs buffers containing decrypted files when the buffers are closed (including when the program is closed with such a buffer open)? --- BUG REPORT ENDS HERE If Emacs crashed, and you have the Emacs process in the gdb debugger, please include the output from the following gdb commands: `bt full' and `xbacktrace'. For information about debugging Emacs, please read the file /usr/share/emacs/24.3/etc/DEBUG. In GNU Emacs 24.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.10.7) of 2014-03-07 on lamiak, modified by Debian Windowing system distributor `The X.Org Foundation', version 11.0.11501000 System Description: Ubuntu 14.04.2 LTS Configured using: `configure '--build' 'x86_64-linux-gnu' '--build' 'x86_64-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib' '--localstatedir=/var/lib' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes' '--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.3/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.3/site-lisp:/usr/share/emacs/site-lisp' '--with-crt-dir=/usr/lib/x86_64-linux-gnu' '--with-x=yes' '--with-x-toolkit=gtk3' '--with-toolkit-scroll-bars' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2'' Important settings: value of $LANG: en_US.UTF-8 locale-coding-system: utf-8-unix default enable-multibyte-characters: t Major mode: Lisp Interaction Minor modes in effect: tooltip-mode: t mouse-wheel-mode: t tool-bar-mode: t menu-bar-mode: t file-name-shadow-mode: t global-font-lock-mode: t font-lock-mode: t blink-cursor-mode: t auto-composition-mode: t auto-encryption-mode: t auto-compression-mode: t line-number-mode: t transient-mark-mode: t Recent input: x r e p o r t - u n s a f e SPC e n c r y p t i o n SPC b e h a v i o r C-x k y e s C-x 0 C-x k x r e p o r t - e Recent messages: Checking 35 files in /usr/share/emacs/24.3/lisp/erc... Checking 24 files in /usr/share/emacs/24.3/lisp/emulation... Checking 74 files in /usr/share/emacs/24.3/lisp/emacs-lisp... Checking 12 files in /usr/share/emacs/24.3/lisp/cedet... Checking 30 files in /usr/share/emacs/24.3/lisp/calendar... Checking 44 files in /usr/share/emacs/24.3/lisp/calc... Checking 40 files in /usr/share/emacs/24.3/lisp/obsolete... Checking 1 files in /usr/share/emacs/24.3/leim... Checking for load-path shadows...done Auto-saving... Load-path shadows: /usr/share/emacs/24.3/site-lisp/debian-startup hides /usr/share/emacs/site-lisp/debian-startup Features: (browse-url help-mode shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt fringe tabulated-list newcomment lisp-mode register page menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak czech european ethiopic indian cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces cus-face macroexp files text-properties overlay sha1 md5 base64 format env code-pages mule custom widget hashtable-print-readable backquote make-network-process dbusbind dynamic-setting system-font-setting font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)