all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Daiki Ueno <ueno@gnu.org>
To: Eli Zaretskii <eliz@gnu.org>
Cc: "N. Jackson" <nljlistbox2@gmail.com>, 29906@debbugs.gnu.org
Subject: bug#29906: 27.0.50; Emacs prompts for passwords in GUI dialog instead of minibuffer
Date: Sat, 30 Dec 2017 21:13:04 +0100	[thread overview]
Message-ID: <87y3lkug8f.fsf-ueno@gnu.org> (raw)
In-Reply-To: <83po6wdrgm.fsf@gnu.org> (Eli Zaretskii's message of "Sat, 30 Dec 2017 20:02:33 +0200")

Eli Zaretskii <eliz@gnu.org> writes:

>> From: nljlistbox2@gmail.com (N. Jackson)
>> Cc: 29906@debbugs.gnu.org
>> Date: Sat, 30 Dec 2017 10:54:31 -0500
>> 
>> At 10:19 +0200 on Saturday 2017-12-30, Eli Zaretskii wrote:
>> >
>> > Does this NEWS.26 entry help?
>> >
>> >   ** The pinentry.el library has been removed.
>> >   That package (and the corresponding change in GnuPG and pinentry)
>> >   was intended to provide a way to input passphrase through Emacs with
>> >   GnuPG 2.0.  However, the change to support that was only implemented
>> >   in GnuPG >= 2.1 and didn't get backported to GnuPG 2.0.  And with
>> >   GnuPG 2.1 and later, pinentry.el is not needed at all.  So the
>> >   library was useless, and we removed it.  GnuPG 2.0 is no longer
>> >   supported by the upstream project.
>> >
>> >   To adapt to the change, you may need to set 'epa-pinentry-mode' to the
>> >   symbol 'loopback'.

I wasn't aware of this entry.  Would it really make sense, given that
pinentry.el was a new library introduced in Emacs 26?

>> Yes, that does help, thank you. I should have checked the news.
>> 
>> It doesn't help me decide what to do though. Do you know if using
>> the prompt in the minibuffer (using `loopback') is thought to be
>> less secure than using the external pinentry program?
>
> I don't know enough about this to tell.  Daiki, any inputs?

I would say it's provides the same level of security as pinentry-gtk,
which no longer uses secmem these days.

It's unfortunate that one of the GnuPG contributors (who currently seems
inactive) had advertised that it was less secure, based on his Emacs 19
knowledge:
https://dev.gnupg.org/T2034#89059

Sigh.  I am really disapponted with the recent development of GnuPG
(failed attempt of standardization, immature implementation of TOFU, FUD
like this, etc).

Regards,
-- 
Daiki Ueno





  reply	other threads:[~2017-12-30 20:13 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-30  2:11 bug#29906: 27.0.50; Emacs prompts for passwords in GUI dialog instead of minibuffer N. Jackson
2017-12-30  8:19 ` Eli Zaretskii
2017-12-30 15:54   ` N. Jackson
2017-12-30 18:02     ` Eli Zaretskii
2017-12-30 20:13       ` Daiki Ueno [this message]
2017-12-30 20:53         ` Eli Zaretskii
2017-12-30 21:06           ` Daiki Ueno
2018-01-09 18:33             ` Glenn Morris
2018-01-15 21:11               ` Glenn Morris
2018-01-16 16:57                 ` Eli Zaretskii
2019-09-28 23:18 ` Stefan Kangas
2019-10-30 20:14   ` Stefan Kangas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87y3lkug8f.fsf-ueno@gnu.org \
    --to=ueno@gnu.org \
    --cc=29906@debbugs.gnu.org \
    --cc=eliz@gnu.org \
    --cc=nljlistbox2@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.