Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

[Matthias Weckbecker <mweckbecker () suse de>]

On Friday 21 September 2012 23:47:48 Michael Gilbert wrote:
[...]
> So anyway, I suppose this creates more questions than answers, but I
> guess its worth thinking about.  After all, what did the user really
> expect?  If they had intended that original file to be private, and
> now its not, is that appropriate?  Is it more appropriate to assume
> all users know how to use umask appropriately?

IMO if one bothers to encrypt a file at all it was certainly intended to be
private and only supposed to be readable by a certain user / user group and
not by just everyone. Otherwise encryption would be pointless, or are there
any other reasons for encrypting a file?

> Best wishes,
> Mike

Thanks, Matthias

-- 
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)