GPG: Deprecated hash + local "game over" exploit

[Steve Kinney]

On 07/01/2017 07:30 PM, Shawn K. Quinn wrote:
> On 07/01/2017 03:17 PM, Steve Kinney wrote:
>> Last time I checked, this bug was dismissed by Debian as a non-issue,
>> saying that exploiting it would require physical access to the machine
>> and "physical access is game over."  That's an excuse to leave the bug
>> in place, not a reason.  I am sure present company can provide several
>> examples of cases where the presence of gnupg-agent in its present
>> broken condition "is game over" for the user.
> 
> Are you sure you didn't accidentally save your passphrase to your GNOME
> password manager (seahorse)? I thought I had the same problem where
> passphrases were being cached far longer than they should be, until I
> found this "helpful" remembering of my passphrase (which I have since
> fixed).

Quite sure:  Taking measures to specifically deny the passphrase to
gnupg-agent fixed the problem at once.  Also, I was using KDE4 at the
time, on a system where Cinnamon is the default desktop.

> I'm going to do some further testing; I have explicitly added the
> supposed default TTL values to gpg-agent.conf and I will see if I still
> have issues.

I created gpg-agent.conf and put it in the right directory per the man
page, because it was not there... and it had no effect.

Especially disturbing because, although I never have a reason to type a
GPG pass phrase as an administrator, logging out of my user account did
not remove the pass phrase from memory.  Nothing short of powering off
did the job.

:o/