Subject: Re: PINE 3.92 - [PGP] - When!?

From: Jamey Maze <[email-masked]>
Date: Wed, 16 Aug 1995 10:31:16 -0400

At 6:01 PM 8/15/95, Kevin C. Dorff wrote:
>How about you press a key and it asks for passphrase and THEN signs
>the letter.
>
>How about you read the message, notice it is encrypted and you ask it
>to decrypt the message and it asks for passphrase and THEN decrypts
>the letter.
>
>BUT, all of these should be options INSIDE the mailer.

Personally, I'd prefer to only have to enter my passphrase once during a
session. If I quit and restart Pine, then I'd enter it again.

On multiuser systems at my site, we have a daemon that automatically logs
you out if you've been inactive for more than 15 minutes. For folks with
workstations or PCs, we strongly recommend users run a password-protected
screen saver so that if someone tries to break into their machine,
hopefully they'll have to reboot to defeat the screen saver and then any
in-memory passphrase would be lost.

Maybe there could be an option for Pine to not save the passphrase for
those who are not comfortable with that sort of operation.

--
Jamey Maze
Lockheed Martin Energy Systems
Oak Ridge National Laboratory

---

From: [email-masked] (Chris D. Halverson)
Date: 16 Aug 1995 10:48:19 -0500

>>>>> "Jamey" == Jamey Maze <[email-masked]> writes:
In article <v03002a24ac57a838967d@[128.219.128.57]> [email-masked] (Jamey Maze) writes:

 Jamey> Personally, I'd prefer to only have to enter my passphrase
 Jamey> once during a session. If I quit and restart Pine, then I'd
 Jamey> enter it again.

The problem then is, where does Pine keep the pass phrase? If it's in
memory or a tmp file, then it's available to anybody on the
system. This is not a good thing. I have my own workstation here, I
use Pine via IMAP to read my mail. None of the other engineers here
have to ever get on my machine (they all have their own), but I still
wouldn't feel comfortable having my pass phrase sticking around all
day (I leave my Pine session up from about 8am-5pm).

 Jamey> Maybe there could be an option for Pine to not save the
 Jamey> passphrase for those who are not comfortable with that sort of
 Jamey> operation.

If so, it should default to not keeping it and then have some sort of
timeout (say 30mins) that it will drop the phrase. By keeping the
phrase around, it defeats the purpose of having one in the first
place, at least on a multi-user system as people don't have to log in
to your console to get to the machine. Environment variables are no
better protected.

I want PGP/Pine to be easy to use, but I don't want to give up the
functionality of PGP by having Pine be too "smart", ie. keeping pass
phrases, auto-signing/decrypting messages, etc. It should always
prompt for a pass phrase.

-- 
Chris D. Halverson                |  Network Engineer
Minnesota Regional Network        |  Voice: (612) 342-2838
511 11th Avenue South, Box 212    |  Email: [email-masked]
Minneapolis, MN  55415            |  WWW:   http://www.MR.Net/~cdh/
    PGP signed/encrypted mail accepted, finger for PGP public key