Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

[Michael Gilbert <michael.s.gilbert () gmail com>]

On Mon, Sep 24, 2012 at 8:24 PM, Michael Gilbert
<michael.s.gilbert () gmail com> wrote:
> On Mon, Sep 24, 2012 at 5:46 PM, Tavis Ormandy wrote:
> > > > I think you've misunderstood the problem, and it's trivial to solve.
> > >
> > > No, I'm thinking about the broader implication.  If you're arguing that
> > > gpg should be modified to better handle permissions, then all applications
> > > potentially handling sensitive information should as well: file editors,
> > > and what not.  Otherwise, what makes gpg such a special case?
> >
> > I think you've confused my post with someone elses.
>
> See Steve Christy's snowball post.  Again, I'm considering the
> totality of the system.  Setting 644 as a default for gpg is I suppose

Correction, not 644, but using the input file's permissions as the
basis for the output file's permissions (obviously before applying
umask).

Best wishes,
Mike