Re: Storing sensitive data indefinitely in variables or buffers: Whether and how to fix?

[Adam Porter <adam@alphapapa.net>]

Thanks to all for the discussion on this thread.

IMHO expiry is an orthogonal issue to, at least, the kind of backend 
data storage/retrieval library I'm asking for.  I think it should be up 
to the application to prune the data according to its needs.  The 
storage API should simply save and return data to the application.  So 
if the application wants to expire some data, it should retrieve the 
collection, discard elements it doesn't need anymore, and rewrite the 
collection using the library's API.

plstore looks like an interesting library, but even that looks like more 
than the simple solution I'm wishing for.  I'm not sure that, as an 
application author, I should need to care about which keys in a record 
are encrypted or not.  I just want to do something simple and Lispy, like:

   (alist-get "@alphapapa:matrix.org" (secure-storage 'ement-sessions))

To get my Matrix session's data.  Or:

   (map-nested-elt (secure-storage 'ement-sessions) 
'("@alphapapa:matrix.org" token))

to get that session's token.  And then:

   (setf (map-nested-elt (secure-storage 'ement-sessions) 
'("@alphapapa:matrix.org" token)) "foobarbaz")

to write the data to the secure storage.  And then the secure-storage 
library should automatically handle the encryption/decryption, 
filesystem location, backend format, prompting the user for a key and/or 
caching it appropriately, etc.

I think this is the simplest kind of API that could be useful to 
applications--and it would be really useful.