I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the .offlineimaprc file to be encrypted so you're not storing it in plain text. However, I have enabled home directory encryption, so unless I'm logged in, the file should be encrypted.

I guess that brings me to the question: is this good enough? I'm fairly security-conscious, and don't want to do something stupid and leave myself vulnerable. I lock my computer when I'm away, or I shut it down. Is home directory encryption enough to keep my .offlineimaprc file secure from most malicious attacks? Or is there some big vulnerability I'm not thinking of?


3 Answers 3


Home directory encryption only helps when you are not logged in, right? So that protects you from physical device theft. But many of threats also happen while you are logged in, like malware?


Is home directory encryption enough

...is a question we can't answer. Defending your PC from the NSA is different from defending it from randmon malware floating about the internet.

While one can imagine all sorts of elaborate schemes involving additional users and pam_mount, the protections afforded are little different from putting the config file in a different location / with a different name. The process you start must be able to read the file.

One bit of polishing which might add some value is to use a seperate encrypted filesystem using your current password to mount. Mount it with pam_mount, then in your session startup, run a script to invoke offlineimap as a daemon - when this returns, sleep for a couple of seconds before unmounting the filesystem containing the config file. Thus, the file containing the credentials is only exposed for a brief period.


If the file is not encrypted, then you need to be extra careful that you don't accidentally expose that file. Many a browser profile or settings file including unencrypted passwords have wound up in online file-sharing, backup, help forums, or similar services.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .