# No plaintext passwords, please!

Try to keep your passwords out of your dotfiles. In many
cases, this can be done with gpg (or a command line based [password manager](https://www.passwordstore.org)).

Here are some examples:

## MSMTP

In the `.msmtprc` you can use `passwordeval` instead of `password` and make
it retrieve the password using a command.

```
passwordeval "gpg -d $HOME/.msmtp-pw.gpg"
```

## OfflineIMAP

Offlineimap supports to retrieve the password using a python program
that implements a "get_pass" function. We can use this by writing a
little python script that calls gpg or the password manager.

In the `.offlineimaprc` set the python file and remotepasseval. The
get_pass function takes 3 arguments, which are used to select the
correct password from the file.

```
pythonfile=~/.offlineimap.py
remotepasseval=get_pass("mail","user","993")
```

Create a file `~/.offlineimap.py` with the following content:

```
#!/usr/bin/python3
import re, os
def get_pass(machine, login, port):
    s = 'machine %s login %s port %s password ([^ ]*)\n' % (machine, login, port)
    p = re.compile(s)
    authinfo = os.popen("gpg -d /home/sdk/.offlineimap-pw.gpg").read()
    return p.search(authinfo).group(1)
```

The password file needs to contain entries like below. More than one
entry is supported. So if you have more than one account configured, you
can call `get_pass(...)` multiple times and select different passwords
for each account.

```
machine mail login sdk port 993 password securepassword
```

## Mutt

In `~/.muttrc`, we can use the `source` command to read configuration entries.

```
source "gpg -d $HOME/.mutt-pw.gpg |"
```

The password file needs to contain valid mutt configuration options:

```
set imap_pass=supersecurepassword
set imap_user=sdk
```

## Vim can help...

Vim does not need a password, but it can help with those gpg files.
Instead of decrypting/changing/encrypting these password files, you can
use the [vim-gpg plugin](https://github.com/jamessan/vim-gnupg), which does
that for you. Once it's installed, you can edit `.gpg` files directly and it
takes over the cumbersome de/encryption.

## password-store

I'm using password-store for the task instead of gpg. This works by replacing
all the "gpg -d $file" commands with the corresponding "pass $folder/$account"
command. It works the same way, but password-store takes care of editing the
files and also versions and syncs them across devices (using git).
