bug#9113: 24.0.50; auth-sources: .authinfo versus .authinfo.gpg

["Roland Winkler" <winkler@gnu.org>]

If an authinfo file does not exists and the user has not customized
anything, something like smtpmail will create a new file .authinfo
with the appropriate entry.

I suggest that instead the code should try first to generate a file
.authinfo.gpg and if this fails it should warn the user that Emacs
is going to create a file .authinfo, which can be very unsafe.

In this context, the doc string of auth-sources is, unfortunately,
not too helpful:

  See the auth.info manual for details.
  [snip]
  It's best to customize this with `M-x customize-variable' because
  the choices can get pretty complex."

The default value of auth-sources should be such that the user is,
at least, on the safe side.


In GNU Emacs 24.0.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.20.1)
 of 2011-07-16 on regnitz
Windowing system distributor `The X.Org Foundation', version 11.0.10706000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: en_GB.utf8
  value of $LANG: en_US.ISO-8859-15
  value of $XMODIFIERS: nil
  locale-coding-system: iso-latin-9-unix
  default enable-multibyte-characters: t

Major mode: Mail