How easy would it be to create (and prevent the creation of) a fake pinentry?
lists at 404not-found.de
Wed Apr 29 15:31:51 CEST 2009
On Wednesday 29 April 2009 12:09:02 Olivier Mehani wrote:
> Let me explain: having several background-ish applications making use of
> the agent, it happens that the pinentry sometimes pops out when the
> passphrase cache has expired. One of my first concerns is that there's
> no way to identify which application actually needs to use my PGP key.
> This one seems to be partially addressed in , as the application
> could set the title of the pinentry program.
The pinentry should only pop up when the application actually needs the key do
do something. If pinentry pops up without you doing someting that requires
your secret key, you should be worried.
And the problem is not specific to pinentry: in order to steal passphrases on
the console you could as well install a gpg wrapper script or binary.
> And, then, how can that be prevented? (I mean beside the obvious “don't
> get your computer hacked” solution)
I think if someone has this kind of control (executing arbitrary code on your
machine), there is no way to prevent passphrase stealing. Am I wrong here?
More information about the Gnupg-users