Implications of using insecure memory

[shatadal at vfemail.net]

Quoting "Shawn K. Quinn" <skquinn at xevious.kicks-ass.net>:

> On Saturday 02 October 2004 18:29, shatadal at vfemail.net wrote:
> > Hi,
> >
> > I am a new user of gnupg. I use gnupg on my windows laptop and linux
> > desktop. Thie first time I tried to run gpg on linux as a user I got
> > the insecure memory warning:
> >
> > "gpg: WARNING: using insecure memory!"
> >
> > On reading the faq I read
> >
> > "On some systems (e.g., Windows) GnuPG does not lock memory pages and
> > older GnuPG versions (<=1.0.4) issue the warning:
> >
> > gpg: Please note that you don't have secure memory
> >
> > This warning can't be switched off by the above option because it was
> > thought to be too serious an issue. However, it confused users too
> > much, so the warning was eventually removed"
> >
> > As a new user I want to know what are the implications of using gpg
> > with insecure memory in windows and linux, how serious are they and
> > what steps can I take to improve security? Does insecure memory mean
> > that I should not use gpg on sych systems?
>
> The security risks from using Windows are such that I would be very
> leery of relying on an encryption application to provide any security
> on a Windows computer.
>
> As far as GNU/Linux, it's simple to get rid of this warning, you can
> simply run "chmod u+s `which gpg`" (GnuPG will detect that it's running
> setuid root and drop privileges).

Another poster also talked about getting rid of windows. However I do need to
run windows from time to time. Also I do not have root access on my linux
machine (it is used at work). So does that mean that gpg is not for me? Or is
there anything available which could erase the swap space anytime I want? I
just looked around in the M$ knowledgebase and it has a workaround to clear the
pagefile at shutdown. Is that a useful compromise?

>
> --
> Shawn K. Quinn
>




-------------------------------------------------
This mail sent through Virus Free Email
http://www.vfemail.net