Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Sep 2012 10:33:12 +0200
From: Matthias Weckbecker <>
Subject: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

On Friday 21 September 2012 23:47:48 Michael Gilbert wrote:
> So anyway, I suppose this creates more questions than answers, but I
> guess its worth thinking about.  After all, what did the user really
> expect?  If they had intended that original file to be private, and
> now its not, is that appropriate?  Is it more appropriate to assume
> all users know how to use umask appropriately?

IMO if one bothers to encrypt a file at all it was certainly intended to be
private and only supposed to be readable by a certain user / user group and
not by just everyone. Otherwise encryption would be pointless, or are there
any other reasons for encrypting a file?

> Best wishes,
> Mike

Thanks, Matthias

Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg) 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.