#287 "Remember for n idle minutes" often stores key in memory for arbitrary lengths of time

[Thanks But No]

The "remember for n idle minutes" option on the GPG key password is completely broken on OS X, both on Intel and PowerPC (with Tenfourbird). Sometimes it functions as expected, many times, however, a few messages can be sent later with the password/key still clearly cached, hours or even days after the "n minutes" expired, before the password/key will be flushed.

This can also happen through sleep/wake cycles on a laptop.

If never checking the "remember for n idle minutes" box is used as a workaround, the user may be prompted more than once to enter the key password.

[Ludwig Hügelschäfer]

This is still present in 1.7.2.

[Ludwig Hügelschäfer]

Fixed on trunk. Will be available on tomorrows nightly version.

[Thanks But No]

THANK YOU! :)

[Jani Patanen]

Fedora 20, mate desktop 1.8.1, thunderbird 31.2,
enigmail nightly build 1.8a1pre (20141110-0013)

I can't get enigmail to forget the passwords. Changing the timeout value results to message stating enigmail cannot connect to gpg-agent.
I've enabled gnome keyring: gpg agent -> no help
I've enabled MATE keyring: gpg agent (whine gnome gpg agent was disabled) -> no help

Previously both were disabled and enigmail forgot password as expected.

entering: gpg-agent to terminal results to:
gpg-agent: gpg-agent running and available
ps -aef | grep gpg-agent shows no processes.

Any hints on what to try next?

[Ludwig Hügelschäfer]

what is the output of entering

gpg-connect-agent

on the command line? Does it come up with a "> " prompt? (If yes, you can leave with "exit").

[Jani Patanen]

yes, a prompt came up.

(btw, exit is not valid command, ctrl-d did the trick :) )

[Jani Patanen]

Just to be sure it's not my own modifications causing the issue, I installed Fedora 20 with Mate desktop to a virtual machine.
Proceed to install thunderbird and enigmail (nightly build 18-11-2014). Got the same message about not being able to connect to gpg-agent.

[Jani Patanen]

Solution to my problem found at
https://confluence.clazzes.org/display/KH/Preventing+Gnome-Keyring+from+caching+GPG+keys+forever

Basically:
gsettings set org.gnome.crypto.cache gpg-cache-method idle
gsettings set org.gnome.crypto.cache gpg-cache-ttl 120

Perhaps a link to above URI could be provided as a possible solution in the messagebox for cases where gpg-agent is not found.

[Ludwig Hügelschäfer]

Reopened due to this forum thread and individual report.

[Patrick Brunschwig]

This was true for as long as Enigmail kept passphrases in memory. Since we only support gpg 2.0.x and newer, passphrase handling is no longer a task for Enigmail at all.