Tickets :: Comment on [#6872] gpg keys pair

* Your Email Address
* Spam protection	Enter the letters below: ._..__.. ..__ . , \| \| \|\| \|[ __ \./ _\|_\|__\|\|__\|[_./ \|
Comment	>>>>> i think that horde/imp must use keys (and keyrings) contained into > >>>>> the private/hidden directory .gnupg of every user; horde/imp must use > >>>>> gnupg command line (sudo'ed as spamassassin) for every operation > >>>> > >>>> What user directory? Horde/IMP has no access to a user's home directory. > >>> > >>> not horde, but gnupg yes > >>> > >>> if you run gnugp sudo'ed with the logged user, i think it can access > >>> the user's home > >> > >> There is absolutely no requirement that users have accounts on the > >> server running Horde. > > > > but it can; and it can have his .gnupg directory with his > public/private keys and his keyrings already full > > > >> Not to mention that a web process having sudo > >> powers is likely opening up a way bigger security hole than any > >> security shortcomings you are trying to mask. > > > > i don't know... i'm not very expert... but i think that is easier to > "crack" a db that a process ran with sudo
Attachment
Watch this ticket