💾 Archived View for pwshnotes.flounder.online › gemlog › 2022-05-06-vim-secrets.gmi captured on 2022-07-16 at 16:42:00. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2022-06-04)
-=-=-=-=-=-=-
I am vaguely aware that Vim stores information about the file I am working on. This presents a problem if I am working on a file that contains secrets and I do not want to persist those secrets outside their designated storage.
So, it would be useful to know:
A good place to start is to view your current Vim options. Open a new instance of Vim. And enter the set command:
:set
This will show all the current options in a popup.
Here is what I see on my system:
:set --- Options --- autoindent hlsearch mouse=a splitbelow backspace=start ignorecase ruler splitright display=lastline incsearch scroll=11 ttimeout helplang=en linebreak shell=pwsh ttimeoutlen=100 backupdir=~/.cache/vim/backup// directory=~/.cache/vim/swap// fileencodings=ucs-bom,utf-8,default,latin1 guifont=Monospace 14 printoptions=paper:letter suffixes=.bak,~,.o,.info,.swp,.aux,.bbl,.blg,.brf,.cb,.dvi,.idx,.ilg,.ind,.inx ,.jpg,.log,.out,.png,.toc termencoding=utf-8 undodir=~/.cache/vim/undo// Press ENTER or type command to continue
As far as storing information, these three options are relevant:
'backupdir' corresponds to backups. 'directory' corresponds to swap files. And 'undodir' corresponds to undo.
By default, backup files are kept temporarily while writing a file. In my case, I don't mind this behavior. I am concerned about information which persists after I am done editing. Since the backup file is deleted after use, the backup option is fine with me.
The swap file is used to recover your work after a power outage. Looking in my swap directory, I see a lot of cruft left over here. These must be from various system failures in the past. I don't mind having a swap file while I am actively working. But I think it would be a good idea to check this directory for leftovers after I am done working. I can visit the directory at:
~/.cache/vim/swap/
The information to support undo and redo is normally kept in memory and discarded after closing a file. But if you have 'undofile' and 'undodir' set, that information is saved. I have inherited undodir from somewhere in the Manjaro installation. But I do not have undofile set. So, I don't think I have to worry about undo files.
I've already talked about swap, undo, and backup options. The only other relevant option I am aware of is the viminfo option.
viminfo saves information about the working environment including:
I don't have the 'viminfofile' option set. This is why viminfo did not show as output from :set But there is a default location. And my viminfo is saved at:
~/.viminfo
I'll want to exclude this file while I'm working with secret information. Otherwise things like register contents and command history will show up in my viminfo.
So, after examining my environment, I determined that I will have to disable viminfo, and I should check the swap directory after I am done working to make sure there are no leftover recovery files. I don't have to worry about undo or backup files in my situation. And I am not aware of any other cache files. The other files Vim stores in my home directory are used for configuration and not caching.
If I was using a different system, it would have a different configuration. And I would have to examine that system to determine its vulnerability. Read the Vim help files I link to below for more information. The article about encryption discusses the issues related to secrets in Vim and was helpful.
Here are the steps I developed to work with secrets on my system:
I can check for recent changes with this command:
Get-ChildItem -Path "~/.viminfo", "~/.cache/vim/" -Recurse -Force -File |
Where-Object { $_.LastWriteTime -ge ((Get-Date).AddDays(-1)) } |
Sort-Object -Property LastWriteTime -Descending |
Format-Table -AutoSize
Directory: /home/michael
UnixMode User Group LastWriteTime Size Name
-------- ---- ----- ------------- ---- ----
-rw------- michael michael 5/6/2022 08:55 59922 .viminfo
On Linux, the clipboards in X11 will pick up any text you are editing while Vim is open. Normally, this information will be lost when Vim is closed. But you might have a clipboard assistant like Clipman which would keep this information after Vim closes. In that case, you would have to go to Clipman and clear out its history. You might also use a tool like xclip while preparing your secret file. That will hang onto information while xclip is running in the background. Closing xclip will address that issue. Remember that the clipboards in X11 are based on running programs. So closing the relevant programs will clear any secrets from the clipboards. Wayland, macOS, and Windows might have similar issues.
While I've discussed the swap file for Vim specifically, there might also be a general swap file for your entire system. You can check the status of your swap file with the swapon command-line utility. I don't have a swap file on my system. And, to be honest, I'm not sure how to address this issue. If you think your secrets might be exposed there, you will have to search for more information elsewhere.
Also, nothing I've discussed here will address the issue of files persisting in memory. root or a local administrator on Windows will be able to pull the contents of your file from memory while the system is still running or after waking from sleep. If you are worried about this, I believe rebooting will clear that cached memory.
Created: Friday, May 6, 2022
Updated: Friday, May 6, 2022