Posted Nov 13, 2011 20:55 UTC (Sun) by idupree (subscriber, #71169)
[Link]
Specifically, only use vim encryption in vim >= 7.3 (upstream released it in Aug 2010, so e.g. Ubuntu 10.04 LTS definitely doesn't have it). Earlier versions of Vim use a cryptographically unsound encryption scheme, new versions use Blowfish. Also you need to set the right Vim options to prevent information leaks; e.g.
set nobackup
set noswapfile
set nowritebackup
set viminfo=
I suspect noswapfile isn't needed if the announcement I just looked up is correct [1], but without set viminfo= I definitely got information leaks into ~/.viminfo , even though the tutorial Google found [2] fails to mention that. Has anyone thoroughly examined vim to give us a way to confidently use vim encryption securely?
But on the plus side, I predict this Vim feature will still be here in ten years, and I have no confidence that the popular GUI password-specific programs will be the same ones by then...