security - msmtp 和 smtp 帐户密码 - 如何混淆

Question

我配置了 msmtp使用我的 Gmail 帐户。
我显然想避免在配置文件中以纯文本格式写入我的密码。
幸运的是，msmtp 提供了选项 passwordeval它可用于从可执行文件的输出中获取密码。

问题是:我应该如何使用它？

我找到了 here以下建议:passwordeval gpg -d /some/path/to/.msmtp.password.gpg
这对我来说没有多大意义:如果有人能够访问我的配置文件，他肯定会设法运行这样的命令并从 gpg 获取密码。

所以我相信我只有在二进制可执行文件中混淆密码的唯一选择，即使我几乎到处都读到了 这不好!

我不可能破解的实现是:如果 sendmail 进程正在运行，则输出正确的传递，否则给出假传递。

你的建议？
与将通行证存储在二进制文件中不同的其他(更安全)技巧？

Answer 1

来自 Sukima的评论:

The reason gpg -d works is because it requires the private key of the person the file is encrypted to. So just placing that encrypted file in the public it is still encrypted an only one person (the one with the secret key) can decrypt it. It is assumed that the secret key is locked up on the user's machine and not leaked. It also assumes that they have not setup any agents which cache the unlock password while a hacker has direct access to the same machine. All of which is highly unlikely in 99% of all attacks.