* Security consideration
-** `call-process-region' writes data in region to a temporary file
+** Passphrase may leak to a temporary file.
`call-process-region' writes data in region to a temporary file.
-EasyPG does *not* use `call-process-region' to communicate with a gpg
+The EasyPG Library does not use `call-process-region' to communicate with a gpg
subprocess.
-** `(fillarray string 0)' is not enough to clear passphrases
+** There is no way to clear passphrase safely.
If Emacs crashes and dumps core, Lisp strings in memory are also
dumped within the core file. `read-passwd' function clears passphrase
strings by `(fillarray string 0)'. However, Emacs performs compaction
in gc_sweep phase. If GC happens before `fillarray', passphrase
strings may be moved elsewhere in memory. Therefore, passphrase
-caching in Elisp is generally a bad idea.
+caching in elisp is generally a bad idea.
The EasyPG Library dares to disable passphrase caching. Fortunately,
there is more secure way to cache passphrases - use gpg-agent. Elisp