bug#15552: 24.3.50; epa-file-cache-passphrase-for-symmetric-encryption not respected with GnuPG 2.x

[Ted Zlatanov <tzz@lifelogs.com>]

On Tue, 08 Oct 2013 16:03:22 +0900 Daiki Ueno <ueno@gnu.org> wrote: 

DU> Stefan Monnier <monnier@iro.umontreal.ca> writes:

>>> It is documented and I stated a number of times the reason and why
>>> I chose such a lengthy name of the variable and the default is nil:
>> 
>> I understand why it is nil by default, but if the user sets it to t,
>> presumably he doesn't care about the fact that storing the password in
>> Emacs heap is insecure.

DU> When epg.el was written, the intention of the option was the last resort
DU> for those who only have gpg1 and can't use gpg-agent.  Since then, I've
DU> recommended to migrate to more secure way (i.e. using gpg-agent).

OK, so at least note it in the variable docstring.

DU> Given that gpg-agent (gpg2) is now available everywhere, I think there's
DU> no reason to advertise the use of this variable, although at some point
DU> a few people (afaik, only Ted) started exploiting this option to provide
DU> degraded security for usability.

I believe several use it, based on auth-source.el related issues.  But I
haven't kept a list.

DU> So the question is, would we really like to proactively support such a
DU> degraded security in Emacs?

Since you've moved beyond the issue at hand, I think we should start
with considering whether one security model fits all users.  Surely you
agree that this is not as clear as your question makes it sound, and
that at least some of the risk assessment should be up to the user?

Ted