The loopback pinentry

[Bjarni Runar Einarsson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Daniel!

Daniel Kahn Gillmor <dkg at fifthhorseman.net> wrote:
> > I propose to make --allow-loopback-pinentry the default and add an
> > option --no-allow-loopback-pinentry, so that it is possible to disallow
> > the use of the loopback pinentry.  This is a simple change but some
> > advanced use cases of GnuPG would benefit from this (e.g. Mailpile).
> 
> It seems like it's pretty easy for advanced users like Mailpile
> to set allow-loopback-pinentry directly for their running
> gpg-agent (if they need to do so) so that's not a good argument
> for changing the defaults.

Why do you assume we would run our own gpg-agent?

The case where we ship gnupg and everything to a desktop user on
OS X or Windows - yes, of course, we actually have no problems
there, we can pretty much do whatever we like.

It's when we want to play nice with desktop Linux users who
already have gpg and a keychain and a desktop, but still want
remote access to their Mailpile... that's the scenario where
things get complicated. Those users would not be happy with a
separate keychain/config/agent just for Mailpile, and they would
also not be happy if we edited their main config, potentially
other apps, their desktop integration or who knows what else.

As far as I'm concerned this isn't about security - this is
fixing a regression that took place in 2.0 which broke the
ability to use gpg in an unattended/automated way. This proposal
goes a long way to fixing that.

Cheers,
 - Bjarni

- -- 
PageKite.net lets your personal computer be part of the web.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJXF7W6AAoJEI4ANxYAz5SRJmsH/1URs92E27MAF9jXlntkDgr+
M75Qnm0fjNYgfGFhXiqI3eVrc6Do37dK5BoboQS4VK8FUvA6Na13updn0sbMl+UN
RxF6U4BNQQNocC7yUfvSoo/O/hMlcUAHqQRZCBG9u74rslIbgiL/arj1SIXrp3HT
7gr5Y8AurZVZUb/y3FdAzjqUmpBBlxlZEREWjXmtBtUgx0F6eCYE9vgaYqVGEzzs
PPuvXOgvRepsrfio7Xy/efVXaAUdfplhGYFTJkTQ4NJrO/xOaxTVdZTA8htqQ8CC
mQ1U4bxseurjy2acC1myOTp7nV9VFhfXnVbULe+NGUYuxObMgeimS3Cism7qTog=
=IRWG
-----END PGP SIGNATURE-----