Re: org-crypt.el security problem (From: Milan Zamazal)

[Julien Danjou <julien@danjou.info>]

[-- Attachment #1: Type: text/plain, Size: 1063 bytes --]

On Sun, Mar 06 2011, Bastien wrote:

> I've seen org-encrypt-string but I don't see we could use it for the 
> problem at hand.  

Just saying that if you don't use it, youe re-encryption on auto-save
will ask the user for its passphrase if he is not using any agent.

> Also, the purpose is to encrypt the auto-saved buffer and *not* the
> visited buffer -- which I don't know how to do.  

Add org-encrypt-entries to auto-save-hook and org-decrypt-entries-which
were-not-decryped to after-auto-save-hook… which does not seems to
exist. :)


What I can also suggest is to never show the encrypted block in the Org
buffer.

This is what I do in my configuration: on Org file loading, I decrypt
all entries. Therefore I never see the GPG block. When I save,
everything is encrypted, written, and then re-decrypted.

Using org-crypt this way, it would be easy to fix auto-save-hook. With
the current way on letting the user decrypt heading by heading, it does
not seems that easy. :)

-- 
Julien Danjou
❱ http://julien.danjou.info

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]