<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi all,</p>
<p>Not sure whether this is a gpg4win thing or a gpg thing, but it
only happens to me on Windows.</p>
<p>TL;DR: In PowerShell, gpg can easily trick the user into
revealing their password in plaintext. Let me know where the best
place to report this would be.<br>
</p>
<p>When you issue a gpg command with default settings, the following
message is displayed:</p>
<blockquote>
<p><tt>You need a passphrase to unlock the secret key for</tt><tt><br>
</tt><tt>user: "Matthew Orlando <a class="moz-txt-link-rfc2396E" href="mailto:maorlando@gmail.com"><maorlando@gmail.com></a>"</tt><tt><br>
</tt><tt>2048-bit RSA key, ID 5EE7763D, created 2016-09-30 (main
key ID BAA8DA4C)</tt><tt><br>
</tt><tt>_</tt><br>
</p>
</blockquote>
<p>By all appearances, blinking cursor included, it looks like it's
asking you to enter the password on the console. I entered my
password. A couple seconds later, the GUI password agent pops up.
I entered the password there, and my git commit finished.<br>
</p>
<p>Followed by:<br>
</p>
<blockquote>
<p><tt>C:\Users\me> mypassword</tt><tt><br>
</tt><tt>mypassword : The term 'mypassword' is not recognized as
the name of a cmdlet, function, script file, or operable</tt><tt>
</tt><tt>program. Check the spelling of the name, or if a path
was included, verify that the path is correct and try again.</tt><tt><br>
</tt><tt>At line:1 char:1</tt><tt><br>
</tt><tt>+ mypassword</tt><tt><br>
</tt><tt>+ ~~~~~~~~~~~~</tt><tt><br>
</tt><tt> + CategoryInfo : ObjectNotFound:
(mypassword:String) [], CommandNotFoundException</tt><tt><br>
</tt><tt> + FullyQualifiedErrorId : CommandNotFoundException</tt><tt><br>
</tt></p>
</blockquote>
<p>Great. Now my password has been printed FIVE times in my console
window and has to be wiped from my powershell command history. As
a new powershell user, it took a few minutes of googling to learn
how. All the while it's sitting there in command history available
to any process with my credentials.<br>
</p>
<p>Even after experiencing this once or twice, the reaction to
"password needed: cursor" is deeply ingrained and I keep doing it,
or catching myself halfway. I'm pretty sure this is a case where I
can rightly blame the tool.</p>
<p>If I had been using another program that reads from stdin, it
would have received my password as input. I verified this with <tt>gpg
--clearsign</tt>.<br>
</p>
<p> I decided to disable history across sessions entirely to defend
against this, but it's a pretty big loss of convenience, and
really isn't something that users should have to protect against.<br>
</p>
<p>Cheers,<br>
</p>
<p>Cog<br>
</p>
</body>
</html>