Re: netrc field encryption in auth-source

[Ted Zlatanov]

On Thu, 16 Jun 2011 10:32:15 +0200 Robert Pluim <address@hidden> wrote: 

RP> Ted Zlatanov <address@hidden> writes:
>> Applied.  See `auth-source-save-secrets' for the only user-controllable
>> piece of the code.  It should really be using the EPA functions directly
>> instead of relying on the file handlers but I wasn't able to get that
>> working.  Maybe Daiki Ueno could give me a hint.  Or I will get to it
>> eventually...

RP> I just took a look at this, it contains

RP> +(defcustom auth-source-save-secrets nil
RP> +  "If set, auth-source will respect it for password tokens behavior."
RP> +  :group 'auth-source
RP> +  :version "23.2" ;; No Gnus
RP> +  :type `(choice
RP> +          :tag "auth-source new password token behavior"
RP> +          (const :tag "Use GPG tokens" gpg)
RP> +          (const :tag "Save unencrypted" nil)
RP> +          (const :tag "Ask" ask)))

RP> I'm glad auth-source will show respect, but that doc-string is almost
RP> information free.

Damn it, someone noticed ;)

RP> How about something like

RP> "This controls what auth-source will do with password tokens: save them,
RP> ask, store as gpg tokens in .authinfo"

You're just listing the defcustom choices in the docstring itself.  What
if we add choices?  We have to edit the docstring again.

How about "Set this to tell auth-source how to handle password tokens in
unencrypted files."

RP> Also, does ask mean 'ask once', or does it mean 'ask every time'? I'm
RP> personally looking for something that would give me "don't store
RP> passwords and don't ask me about storing them except maybe the first
RP> time".

I'm not sure yet.  Right now it's once per Emacs session, if 'ask, but I
left the default nil since it's 100% experimental.  So users that update
blindly will not be affected at all, for now.

I can certainly use Customize to set it to 'gpg or nil forever after the
first time it's asked.  The problem is, I'm also not sure if it should
be a single global setting.  It feels like something that should be
decided for each individual netrc file.  And if that's the case, maybe
the defcustom should hold that choice in an alist with regex matching.

Ted