Emacs org mode encryption on mac... **won't ask for pw on read**

I have a [diary.org](https://diary.org) I'd like always encrypted. I used diary.org.gpg and it would encrypt the first time but never ask again. After googling I tried default-cache-ttl 0 in ~/.gnupg/gpg-agent.conf And I think it just made it \_always\_ ask for a pw on save, everytime, but still never when I open the file... it just works like magic. It did stop the OS from automagically decrypting the file (other file viewers) Emacs did ask for a password on open after a reboot, and I put in the wrong one. Now when I try to open the file I get: Wrong passphrase: Bad session key. but I'm never prompted for another password. I thought maybe a bad result would give insight, but it seems just a cached pw regardless. **So emacs is also caching passwords somewhere?** The same thing happens when I org-encrypt-entry and decrypt.... prompted for password once and can then crypt/decrpt pgp section without entering a password. Even killing emacs and rerunning doesn't get it to forget the password... shrug. I just want a simple file asking for a password on read, and encrypting on save. Thanks for any help. \------- UPDATE: (another thread mention gpg --card-status not that I know what that means, but more info) ~ $ gpg --card-status gpg: WARNING: server 'gpg-agent' is older than us (2.2.24 < 2.3.8) gpg: Note: Outdated servers may lack important security fixes. gpg: Note: Use the command "gpgconf --kill all" to restart them. gpg: WARNING: server 'scdaemon' is older than us (2.2.24 < 2.3.8) gpg: Note: Outdated servers may lack important security fixes. gpg: Note: Use the command "gpgconf --kill all" to restart them. gpg: selecting card failed: Operation not supported by device gpg: OpenPGP card not available: Operation not supported by device ~ $ ~ $ ~ $ ~ $ gpgconf --kill all ~ $ gpg --card-status gpg: error running '/opt/homebrew/Cellar/gnupg/2.3.8/bin/gpg-agent': exit status 2 gpg: failed to start gpg-agent '/opt/homebrew/Cellar/gnupg/2.3.8/bin/gpg-agent': General error gpg: can't connect to the gpg-agent: General error gpg: OpenPGP card not available: No agent running then tried to open: Decrypting /Users/xxxxxx/org/journal.org.gpg...done user-error: Wrong passphrase: No secret key still didnt prompt after killing gpg killed So the error message changed from bad password to looks like an empty password, but still no prompting.

Try to restart gpg-agent

If you are on mac have you checked whether it has saved this to your keychain? I know on my system somehow OSX sneakliy cadged the passphrase for the gpg key in this instance and now I actually type in the unlock for the system to unlock my stuff. Might be the same for you.

I think thats what was happening before I set the cache time to 0. My mac would just decrypt the file with any app, so I'm assuming it was grabbing the pass from the keychain. I've been manually unchecking "add to keychain" when I encrypt a file (there is a checkbox in the password prompt box), but still emacs is definitely remembering. ie, it knows which password to use when I manually decrypt a random block in place (I don't see my mac storing pws per org bullet, but who knows). I've seen other mentions of this issue online, but no solutions that worked for the OPs.

No joy... ~ $ gpgconf --kill gpg-agent~ $ ~ $ ~ $ gpg-agentgpg-agent[83024]: no gpg-agent running in this session~ $ ~ $ gpg-agent gpg-agent[83032]: gpg-agent running and available No idea why reddit paste doesn't work either, I can paste into textedit just fine and it looks correct. Sigh. Maybe it will display correctly when sent. I killed it, verified it wasn't running, then opened file and got the same issue -- and verified it was running after the file open.

I'd try more directly using ps aux + kill. Note that Emacs may be running in different bash env.

[deleted]

I was in eshell... verified if was running, then killed it and verified if wasn't running, then opened file and verified it autoran again and was running. So it seems confirmed to be as expected on that front.

Even more info, different gpg is getting run from file load than from just running gpg in eshell. So now my eshell data seems suspicious, but have no idea how to operate in whatever path space my emacs is using on mac when it's loading a file (I would have thought eshell would be the same). Here's the info... &#x200B; Copied an org file to be org.gpg outside emacs and then tried to open it: Error while decrypting with "/usr/local/MacGPG2/bin/gpg2": gpg: no valid OpenPGP data found. gpg: decrypt_message failed: Unknown system error Location looks sus, so I check version and then check from eshell. ~/org $ /usr/local/MacGPG2/bin/gpg2 --version gpg (GnuPG/MacGPG2) 2.2.24 libgcrypt 1.8.7 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /Users/me/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Then see what is getting hit from eshell (where I've been checking things) ~/org $ gpg --version gpg (GnuPG) 2.3.8 libgcrypt 1.10.1 Copyright (C) 2021 Free Software Foundation, Inc. License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /Users/me/.gnupg Supported algorithms: ... So same home, different binaries getting run. One during file load, another from eshell. ???

Where in OSX would I look for this? Any idea where you found it or how you fixed it?

In the OSX Ventura, launch the `Keychain Access.app` (on previous versions, I think it was just called `Keychain.app` but don't quote me on that.). Note: I am not a fan of this behaviour. I want my system on desktop to maybe cache my gpg password for 5 min. If you delete the Keychain entry for the respective gpg key, it'll go back to asking you for the password (but then you may need to fiddle with your gpg conf settings for how long it caches your entered password on the system.). lemme know if that helps!

Ok, finding some pws in gnupg listings and the passwords check out... so Ill let you know how it turns out after I delete them all (there are many, with dupes). Now trick is how to stop them from winding up in there in the first place (the store in keychain checkbox defaults to on in the password dialog). Hopefully this works...

doh, didn't change any behavior. still wont load with bad password, so those were some other artifact cache of something else.