I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :)
I keep a couple of (GPG-)encrypted files with more-or-less sensitive information; particularly passwords for various web services. While they are mostly used read-only, I sometimes need to edit them to change or add information, and I worry about how I leak the contents of them when doing so, and what can be done about it.
In particular, what I do is: 1) decrypt the file, 2) edit it with
vi -n (I'm using Linux), 3) encrypt the file again and 4) clear the decrypted file with the
shred utility. I know, however, that this leaves at least the following venues for the contents to leak:
vi's memory is swappable, it may have leaked to the swap partition. I guess this is unlikely due to me having lots of RAM and the editing sessions being brief, but it's clearly a possibility.
- The same can be said for the terminal emulator I'm running
- Worst of all, however, is that
viuses the terminal's "alternate screen", which isn't cleared when
Is there anything that can be done about these, and are there any others that I've missed. I guess there should be some easy way to clear the alternate screen after I've exited
vi, but I haven't found one yet (neither
reset do). The problems about
xterm being swappable, however, seem generally harder to fix.
Can anything be said about general guidelines when editing files with secure contents?