I keep my passwords in PGP encrypted file. When I need to edit this file, then I first decrypt it(gpg -d ...), open the plain-text file in vim and make the changes, encrypt the plain-text file(gpg --output data.gpg --encrypt --recipient ...) and finally remove the plain-text file. How can I be absolutely sure that vim does not store any sensitive data anywhere else than in this plain-text file? I guess I need to disable viminfo and it probably it makes sense to disable plugins as well? So if I use vim -i NONE -u NONE plain-text-file, then I should be secure?

  • 1
    Related: The simplest way to start Vim in private mode Apr 3, 2017 at 16:47
  • 1
    github.com/jamessan/vim-gnupg might be useful.
    – muru
    Apr 3, 2017 at 16:51
  • 2
    Perhaps consider using a dedicated password manager instead. Having a plain text file containing your passwords on a hard drive, even for a limited time, seems risky (since the contents of the file will remain on the disc until overwritten).
    – evilsoup
    Apr 3, 2017 at 22:15
  • 1
    @StandardEyre Thanks for referring to The simplest way to start Vim in private mode question. I finally ended up with vim -Nu .vimrcprivate solution. @evilsoup I try to mitigate those risks with full-disk encryption and when I remove the plain-text file, then I always use shred -u plain-text-file instead of rm plain-text-file.
    – Martin
    Apr 4, 2017 at 10:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.