tag:gpgtools.tenderapp.com,2011-11-04:/discussions/feedback/4945-gpg-or-enigmail-caching-passphrase-without-askingGPGTools: Discussion 2024-03-21T23:51:10Ztag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-11-23T16:13:34Z2017-11-23T16:14:59ZGPG or Enigmail caching passphrase without asking<div><p>For some strange reason GPG and Enigmail now cache my secret-key passphrase in the MacOS keyring in spite of me deleting it every time. I don't remember interacting with a dialog to cache my passphrase. I would never do that. I don't want my passphrase anywhere but in my head. Now I cannot disable this behavior. I don't see anything in gpg.conf that would indicate I want my passphrase cached.</p>
<p>Is this a new feature, a bug, or a config error on my part?</p>
<p>MacOS: 10.12.6<br>
Thunderbird: 52.4.0<br>
Enigmail: 1.9.8.3<br>
GPG: 2.2.0<br>
libcrypt: 1.8.1</p>
<p>Thanks in advance.</p>
<p>Brian</p></div>briantag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-12-09T22:47:48Z2017-12-09T22:47:48ZGPG or Enigmail caching passphrase without asking<div><p>Hi Brian,</p>
<p>this is a change we have introduced in the latest version of GPG Suite, since we found that it makes it much easier for most of our users.<br>
You can quickly disable this feature in System Preferences -> GPG Suite.</p>
<p>Hope that helps.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-12-09T23:26:59Z2017-12-09T23:26:59ZGPG or Enigmail caching passphrase without asking<div><p>On Sat, Dec 9, 2017 at 4:47 PM, Luke Le <a href="mailto:tender2+db1b3dccb1@tenderapp.com">tender2+db1b3dccb1@tenderapp.com</a><br>
wrote:</p>
<blockquote>
<p>// Please reply above this line</p>
</blockquote>
<p>I understand. From a security PoV (and GPG is all about security) this is a<br>
bad idea. The passphrase should NEVER be stored in the clear. Period. End<br>
of report. And yes, it is in the clear if someone has the passphrase to the<br>
keyring.</p></div>briantag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-12-10T01:12:15Z2017-12-10T01:12:15ZGPG or Enigmail caching passphrase without asking<div><p>I understand. From a security PoV (and GPG is all about security) this is a<br>
bad idea. The passphrase should NEVER be stored in the clear. Period. End<br>
of report. And yes, it is in the clear if someone has the passphrase to the<br>
keyring.</p></div>briantag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-12-10T11:01:16Z2017-12-10T11:01:16ZGPG or Enigmail caching passphrase without asking<div><p>Hi Brian,</p>
<p>what exactly do you mean by stored in the clear? The passphrase is stored in macOS's Keychain (encrypted, with your macOS user's password). Of course, if an attacker has access to your computer and account, they would be able to extract the passphrase. At the same time, they could intercept your passphrase when you enter it (it might take a little longer).</p>
<p>We are considering to set this default differently in the future, where the first time pinentry asks for a passphrase, the user is introduced to the advantages and disadvantages of storing the passphrase.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/441172392017-12-10T13:26:10Z2017-12-10T13:26:10ZGPG or Enigmail caching passphrase without asking<div><p>Anyone with the user's password for the keyring has access to the cleartext<br>
version of the user's passphrase. This is a level of security barely above<br>
no passphrase at all. It requires no effort, other than knowing the user's<br>
login password, to compromise the passphrase for the PK. The whole idea is<br>
that the passphrase is not stored in the system but used immediately to<br>
gain access to the user's PK. Even making storing the passphrase for a<br>
short period of time is uncomfortable but I do understand that. Storing the<br>
passphrase in the user's password keyring is just ... wrong.</p>
<p>Yes, set the default differently. Make it difficult to set this very bad<br>
policy. Warn them multiple times. Make them say, "I want to store the<br>
passphrase but I know this is a very bad idea," 100 times.</p></div>brian