I keep my passwords in PGP encrypted file. When I need to edit this file, then I first decrypt it(gpg -d ...), open the plain-text file in vim and make the changes, encrypt the plain-text file(gpg --output data.gpg --encrypt --recipient ...) and finally remove the plain-text file. How can I be absolutely sure that vim does not store any sensitive data anywhere else than in this plain-text file? I guess I need to disable viminfo and it probably it makes sense to disable plugins as well? So if I use vim -i NONE -u NONE plain-text-file, then I should be secure?

  • 1
  • 1
    github.com/jamessan/vim-gnupg might be useful.
    – muru
    Apr 3 '17 at 16:51
  • 2
    Perhaps consider using a dedicated password manager instead. Having a plain text file containing your passwords on a hard drive, even for a limited time, seems risky (since the contents of the file will remain on the disc until overwritten).
    – evilsoup
    Apr 3 '17 at 22:15
  • @StandardEyre Thanks for referring to The simplest way to start Vim in private mode question. I finally ended up with vim -Nu .vimrcprivate solution. @evilsoup I try to mitigate those risks with full-disk encryption and when I remove the plain-text file, then I always use shred -u plain-text-file instead of rm plain-text-file.
    – Martin
    Apr 4 '17 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.