A last word on --passphrase-fd

[Chuck Robey]

On 21 Jan 2000, ESP wrote:

> >>>>> "CR" == Chuck Robey <chuckr@picnic.mat.net> writes:
> 
>     WK> Use unprotected keys.  Encrypting something and storing the key
>     WK> on the same medium remembers if of DVDs :0)
> 
>     CR> Uhh.  I'm not the crypto-whiz you are.  I understand (I think)
>     CR> the DVD story.  Can you tell me why needing crypto signatures
>     CR> on output of a cron job equates to the DVD story?  No sarcasm
>     CR> here, I really don't know.
> 
> I think you missed the point. It's not that you don't need GPG from
> cron jobs, it's that if you -are- using GPG from cron jobs, you
> shouldn't have a passphrase on the key that's used.
> 
> I'm not a crypto-whiz, either, but I think I can make an analogy.
> 
> It's not any good having a great big padlock on your door if you hide
> the key under the doormat. It's a false sense of security to hide the
> key, because it's trivial to find it. So, instead, leave the key in
> the lock, and don't let people get near the door.
> 
> Leaving the key in the lock is -better- than putting it under the mat,
> because it will make you nervous and more conscious about who you let
> near the door, and what you keep behind it.
> 
> Does that make sense? I guess what I'm trying to say is that having
> the GPG key and the passphrase stored in the same place is essentially
> equivalent to having no passphrase at all. So, don't kid yourself and
> go to the trouble of having a passphrase.

That makes sense, yes, thanks (I didn't understand "unprotected").  I am
going to use passphrases because "I was told to", but you make a good
argument, I guess.  I was told adding a passphrase in a fairly well hidden
file would *somewhat* increase it's security.  Of course, if someone gets
root on my machine, it's all up anyhow.

> 
> ~ESP
> 
> 
> 

----------------------------------------------------------------------------
Chuck Robey            | Interests include C & Java programming, FreeBSD,
chuckr@picnic.mat.net  | electronics, communications, and signal processing.

New Year's Resolution:  I will not sphroxify gullible people into looking up
fictitious words in the dictionary.
----------------------------------------------------------------------------