Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

[Michael Gilbert <michael.s.gilbert () gmail com>]

On Mon, Sep 24, 2012 at 5:46 PM, Tavis Ormandy wrote:
> > > I think you've misunderstood the problem, and it's trivial to solve.
> >
> > No, I'm thinking about the broader implication.  If you're arguing that
> > gpg should be modified to better handle permissions, then all applications
> > potentially handling sensitive information should as well: file editors,
> > and what not.  Otherwise, what makes gpg such a special case?
>
> I think you've confused my post with someone elses.

See Steve Christy's snowball post.  Again, I'm considering the
totality of the system.  Setting 644 as a default for gpg is I suppose
a step, but gpg is not the only application handling sensitive data.
If that is the case, then there are a whole lot of other applications
also not doing the right thing with your sensitive data including
those that pipe and redirect stdin/stdout.  Again, I don't know how to
make it any clearer, but I'm considering the broader implications, not
just gpg.  I still don't understand again why gpg is so special?

Best wishes,
Mike