PassPhrase Setter v 1.1.1 (C) 1996 Steven A Davis and Scottsman Software If you find this program useful please slip a US dollar bill in an envelope and send it to me at: Steven A Davis 4814 S. Park RD Rogers AR 72756 email: sda19@specent.com web page: http://www.specent.com/~sda19/ If you don't live in the States then please send me a bill that is roughly equivalent to a US dollar, I can use it as a bookmark. :) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Legalese: This product carries no warranty or guarantee of any kind expressed or implied. It isn't my fault or the programs fault if any harm comes to you, your equipment, your family, house, possessions pets, relatives or any hairs on your chinny-chin-chin. If any information is lost stolen or leaked because of use of this program that's just too dang bad. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is a quickie VB4 project I put together in an afternoon. The README file took longer to write than the app did! What is does is set the PGP Passphrase into the master environment so that you don't have to type in the passphrase every time you use PGP to sign or decrypt a message. Run it once and you're good for THAT entire Windows 95 session. If you reboot and you must enter the passphrase again - there ain't no free lunches. Why use this program? Because setting the PGPPASS variable in the config.sys or autoexec.bat is an open invitation to someone swiping it, anyone with an ounce of sense can look at the files and see your passphrase in plain text right there in front of God and everybody. Using PassPhrase eliminates THAT risk but does require you manually type in the passphrase once per session - a wee bit easier than typing it in every time you use PGP. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ What's required: Windows 95 - Duh! PassPhrase.exe - that's this program WinSet.exe - this is a little program provided with Win 95 on the distribution CD ROM in : \ADMIN\APPTOOLS\ENVVARS\WINSET.EXE Winset sets VARIABLES to the MASTER environment. I guess MS gives it away in a package called ENVAR.EXE over the Internet too, look at www.microsoft.com for ENVAR.EXE. VB4 Runtime files - This is the VB4 runtime module that you need to run ANY VB4 application. Get it at the MS web site. You need only install this ONCE and it puts the needed VB4 files on your system for any and all VB4 apps, I do not include them because they are huge and you might already have them. Look at the MS site or nearly any shareware site. The modules used are vb40032.dll, olepro32.dll and msvcrt40.dll. PGP - Not really necessary but what good is this applet if you don't have PGP? :) US residents can get PGP at: http://web.mit.edu/network/pgp.html None US residents will have to search the web for it. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ How to install: Put PassPhrase.exe in any directory anywhere on your hard disk. Make a shortcut to it and that's it. WINSET.EXE must be on the PATH somewhere, I'd put it in the \windows directory if I were you, find it on the CD ROM the \ADMIN\APPTOOLS\ENVVARS\ dir or go to the MS web site, I believe it's called ENVAR.EXE there. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ How to use PassPhrase.exe: Simply run PassPhrase, type in your passphrase and click the SET IT NOW button. PassPhrase sets the phrase using Winset into the MASTER DOS environment, when PGP is run it will sense the PGPPASS= variable and not ask you for it. By setting the MASTER environment it is available globally to any DOS session running PGP, including those run by PGP "shells" that you don't see running. FORGET PASSPHRASE - wipes the phrase from the environment DON'T SHOW PASSPHRASE WHILE TYPING - toggles between showing and not showing the passphrase in plain text- If you type real bad you might want to click this every time. Default is ALWAYS set to DON'T. ERASE PASSPHRASE - just a handy button to erase the text in the box, it doesn't set or forget anything, just use it to erase the text if you suspect you goofed your typing job up. ABOUT - just an ad. CANCEL - what it says. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Understanding the MASTER environment: When PassPhrase is started and your passphrase is set, any DOS session ALREADY running will NOT be updated - that's because that session gets a copy of the MASTER environment only when the secondary command processor (command.com) starts. You can check the function of PassPhrase by starting a windowed DOS session and typing SET at the command line. Note that unless you already SET the PGPPASS variable in the config.sys / autoexec.bat or with PassPhrase there should be NO listing for PGPPASS in the variables shown. Exit THAT DOS session and run PassPhrase and set the phrase, then start ANOTHER DOS session. Type SET and you will now notice that one of the variables shown will be your PGP pass phrase (or whatever goofy text you typed in) in back of the word PGPPASS=. You can click the FORGET PASSPHRASE button on PassPhrase and it effectively wipes out the variable, neat huh? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Security issues: After all that's what PGP is all about isn't it? PassPhrase does NOT store your passphrase anywhere on disk or internally to itself, it merely sets the environmental variable and exits. There is some risk though. Windows is notorious for writing things in the swap file or tmp files, while nothing about PassPhrase does this in and of itself, Windows might take a hankering to write down this juicy bit of info somewhere. To combat this (which may very well be a risk using ANY PGP Windows shell), you need to either use an Empty Cluster disk wiper or Swap File wiper, there are tons to choose from and I'll leave it up to you as to which to choose. I use ZAPUTILS, you'll have to look around the Internet for it. The risk is slight and typically is not much of a threat but you have to decide what level of risk to accept. PassPhrase does NOT display your passphrase in plain text - asterisks are shown, unless you click the SHOW button. You can check the passphrase by running a DOS session and typing SET and seeing what it says. Remember when leaving your running PC unattended for a while to WIPE your passphrase by clicking the FORGET PASSPHRASE button, but remember the swap file issue and the fact that ANY DOS session started AFTER setting your passphrase and left running even after clicking FORGET PASSPHRASE still has the variable set in it. So if you saunter away and some evil spy lurks up and types SET in that still running DOS session, you're sunk. Also some PGP SHELL apps might KEEP the variable if left running, even with the DOS variable wiped. If you are THAT concerned over security, exit Win 95 and restart the PC when you step away, either that or tie a Doberman to the keyboard :) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Potential problems: You might not have enough environmental area. This is a DOS problem and shouldn't really crop up to often. It might if you use like a 500 letter passphrase. If some error pops up saying OUT OF ENVORONMENT or it plain don't work try boosting the environmental areas size. Do this in the config.sys with a line something like: shell=c:\command.com c:\ e:### /p Don't put the line in if it's already there! The ### is some number, try 512 if no number is present, if it still doesn't work try 768, 1024 or 2048. Note that the DOS 7.0 version of command.com (the one that comes with Win 95) needs to be in whatever directory you point to with the shell= statement. Your Windows shell might not accept the PGPPASS variable. I tested this with PGPClick (which is a GREAT shell) and Aegis Shell and it worked fine, maybe your shell doesn't accept it, I can't do anything about that, just use one that does. Or maybe you have to TELL the shell to use the variable with some setting somewhere on it's menus, like they say RTFM. No winset.exe available. Beg borrow or steal one. It's on the Win 95 upgrade CD ROM, I don't know about diskettes (the 3.5" disk install of Win 95 sucks anyway, get a CD ROM :) ) I guess they have it at the MS website too, I think it's called ENVAR.EXE there. If you don't use some sort of Windows unZipper the long file name on PassPhrase.exe may be truncated, no sweat, just use Explorer or File manager to rename it to PassPhrase.exe. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You may not think this app is worth even a dollar, well maybe it isn't so don't fret about it. If you like it you can show your appreciation by sending a dollar to me. No bombs, timers or anything to nag you, just your guilty conscience about a poor starving guy here hunched over his keyboard worrying about where his next meal is coming from, he checks the mail daily just waiting to hear from you and send that ONE LOUSY STINKING GREENBACK THAT YOU'LL NEVER EVEN MISS ANYHOW to him. But don't let all that sway your decision. Nope, keep your lousy old money. :) At least visit my web page and send me email you tight wad ! :)