From a651d4876f775a2b00f88df49ead47557c6cc18e Mon Sep 17 00:00:00 2001
From: Simeon Simeonov
Date: Sun, 15 Apr 2018 16:28:33 +0200
Subject: Call unload_password every 10th minute when
 prefs_common.auto_unload_master_password is set. Update the documentation.

---
 README.md  | 15 +++++++--------
 src/main.c |  3 +++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 9ca9b99..1cf6d21 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,9 @@ prompt for the master password.
 - A should not be able to craft an edited password without obtaining the
   master password.
 
+- A should not be able to compromise the master password or force Sylpheed
+  to store decrypted passwords even if she has access to a running Sylpheed.
+
 - a warning / prompt should be given if a user accidentally types in a "wrong"
   master password before decryption is initiated.
 
@@ -61,6 +64,9 @@ prompt for the master password.
 
 - set your new passwords from the "Configuration" -> "Edit accounts..."!
 
+- select "Automatically unload master password after session initialization"
+  for increased security and decreased convenience.
+
 Note:
 Sylpheed will automatically convert existing stored passwords, but it will not
 touch your backups. You will have to remove all remnants of plain-text
@@ -201,13 +207,6 @@ Operation:
 
 ### Limitations
 
-- when Sylpheed starts, the master-password is loaded into memory and remains
-  there as long as Sylpheed is running. Currently no strong mechanisms,
-  preventing someone with access to the memory from snatching it,
-  are implemented.
-  "Unloading" the master-password immediately after
-  account-processing (decryption) should be considered in the future.
-
 - currently only the 'password' and 'smtp_password' keys in accountrc
   are encrypted.
   A mechanism that allows for any key and even folders to be encrypted
@@ -217,4 +216,4 @@ Operation:
   and modes of operation (without editing the source code).
 
 - currently it is not possible to change your master password without having to
-  set your passwords manually.
+  (re)set your passwords manually.
diff --git a/src/main.c b/src/main.c
index 97a4bd0..7c37e96 100644
--- a/src/main.c
+++ b/src/main.c
@@ -426,6 +426,9 @@ int main(int argc, char *argv[])
 	if (prefs_common.auto_unload_master_password && master_password_active()) {
 		debug_print("Auto unloading master password\n");
 		unload_master_password();
+		/* call this function every 10th minute in case a reload took place */
+		/* TODO: Perhaps a more elegant solution could be developed */
+		g_timeout_add(1000 * 60 * 10, unload_master_password, NULL);
 	}
 #endif
 
-- 
cgit v1.3