Is it possible to cancel the warning about `gopass edit <password>`?

[telemachus]

Summary

gopass helpfully warns that the user's editor (vim in my case) may leak secrets, and gopass helpfully suggests how to make the editor more secure. However, even after I have secured my editor, gopass continues to issue that warning whenever I try to edit a pass entry.

I think it should be possible for the user to squelch that error, but I can't see a way to do so.

Steps To Reproduce

Enter gopass edit <password>.

Expected behavior

In an ideal world with unicorns and rainbows for everyone, gopass would automagically detect that the user had followed its advice and stop warning once the editor was secure. But I doubt that's feasible. (gopass almost certainly can't check all of a user's start-up files.)

I would happily settle for a setting the user could enter to silence the warning.

Environment

• OS: macOS Catalina
• OS version: Darwin 19.6.0 Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64 x86_64
• gopass Version:

gopass 1.12.5-git+HEAD go1.16.3 darwin amd64
<root>     - gpg 2.2.27 -   fs 0.1.0
Available Crypto Backends: age, gpgcli, plain
Available Storage Backends: fs, gitfs

• Installation method: go get

Additional context

This is obviously not high-priority, but from a UX perspective, I think a permanent warning is not ideal.

[arren-ru]

I faced the same problem and looked around for the way to disable it and found that checking vim secureness is poor and just based on the reges match in vimrc file. I personally don't like idea when software opens not it's own configs and files and this behavior can not be disabled, by the way idea is good but for newbies.

I have this in my config for a long time:

aug gopass
    au BufNewFile,BufRead /private/**/gopass**,/dev/shm/gopass.*
                \ setlocal noswapfile nobackup noundofile | set ft=gopass
aug end

And adding this inside the autocommand group may fix the problem of warning because it's not detecting if the options are really set

    " au BufNewFile,BufRead /private/**/gopass** setlocal noswapfile nobackup noundofile
    " au BufNewFile,BufRead /dev/shm/gopass.* setlocal noswapfile nobackup noundofile

[AnomalRoil]

I guess we could add a environment variable to disable it.

Currently we are just using regex on the .vimrc file, where are you config stored?? https://github.com/gopasspw/gopass/blob/d00c29a0e8e521eb32e4564998690430dcc7dbbc/internal/editor/editor.go#L36

[dominikschulz]

Should we re-use an existing env variable or introduce a new one for this?

[AnomalRoil]

Otherwise we could use a dotfile within the password store. Like: do not check warning if there is a .nogopasswarning file in the password store...

[dominikschulz]

Yes, this was something we did discuss before. But I don't have a good design for that, yet.

[BoostCookie]

I think it is generally a lost cause to sniff into peoples' config files and try to interpret what the editor will do. People could write their settings slightly differently and gopass would not recognise it anymore. (neo)vim also has complicated procedures to select the vimrc / init.vim that will actually be used, and it does not sound like fun to mimic this exact behaviour. It also does not sound like fun to run (neo)vim as a test and find out what $MYVIMRC gets set to.

I think we should either enforce the behaviour we want, by adding arguments when it is a known editor like (neo)vim

nvim -c ":setlocal noswapfile nobackup noundofile shada=" <filename>
vim -c ":setlocal noswapfile nobackup noundofile viminfo=" <filename>

or we should just let it be.

[dominikschulz]

This should have been fixed with https://github.com/gopasspw/gopass/pull/2343.