             PassPhrase Setter v 1.1.1
    (C) 1996 Steven A Davis and Scottsman Software

If you find this program useful please slip a US dollar bill in an
envelope and send it to me at:

Steven A Davis
4814 S. Park RD
Rogers AR 72756

email: sda19@specent.com
web page: http://www.specent.com/~sda19/

If you don't live in the States then please send me a bill that is roughly
equivalent to a US dollar, I can use it as a bookmark. :) 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Legalese:  

      This product carries no warranty or guarantee of any kind 
      expressed or implied.  It isn't my fault or the programs fault if 
      any harm comes to you, your equipment, your family, house, possessions 
      pets, relatives or any hairs on your chinny-chin-chin.  If any information 
      is lost stolen or leaked because of use of this program that's just 
      too dang bad.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This is a quickie VB4 project I put together in an afternoon. The
README file took longer to write than the app did!
What is does is set the PGP Passphrase into the master environment
so that you don't have to type in the passphrase every time you use
PGP to sign or decrypt a message. Run it once and you're good for
THAT entire Windows 95 session.  If you reboot and you must enter the
passphrase again - there ain't no free lunches.

Why use this program? Because setting the PGPPASS variable in the
config.sys or autoexec.bat is an open invitation to someone swiping 
it, anyone with an ounce of sense can look at the files
and see your passphrase in plain text right there in front of
God and everybody. Using PassPhrase eliminates THAT risk but does 
require you manually type in the passphrase once per session - a wee
bit easier than typing it in every time you use PGP.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

What's required:

Windows 95 - Duh!

PassPhrase.exe - that's this program

WinSet.exe - this is a little program provided with Win 95 on the 
       distribution CD ROM in : \ADMIN\APPTOOLS\ENVVARS\WINSET.EXE 
       Winset sets VARIABLES to the MASTER environment. I guess MS
       gives it away in a package called ENVAR.EXE over the Internet 
       too, look at www.microsoft.com for ENVAR.EXE.

VB4 Runtime files - This is the VB4 runtime module that you need to run
       ANY VB4 application.  Get it at the MS web site.
       You need only install this ONCE and it puts the needed
       VB4 files on your system for any and all VB4 apps, I do not 
       include them because they are huge and you might already have 
       them. Look at the MS site or nearly any shareware site.
       The modules used are vb40032.dll, olepro32.dll and msvcrt40.dll.


PGP -  Not really necessary but what good is this applet if you don't 
       have PGP? :)

       US residents can get PGP at:
       http://web.mit.edu/network/pgp.html

       None US residents will have to search the web for it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

How to install:

       Put PassPhrase.exe in any directory anywhere on your hard disk.  
       Make a shortcut to it and that's it.  WINSET.EXE must be on the
       PATH somewhere, I'd put it in the \windows directory if I were 
       you, find it on the CD ROM the \ADMIN\APPTOOLS\ENVVARS\ dir or
       go to the MS web site, I believe it's called ENVAR.EXE there.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

How to use PassPhrase.exe:

       Simply run PassPhrase, type in your passphrase and click
       the SET IT NOW button. PassPhrase sets the phrase using 
       Winset into the MASTER DOS environment, when PGP is run it will
       sense the PGPPASS= variable and not ask you for it.  By setting
       the MASTER environment it is available globally to any DOS
       session running PGP, including those run by PGP "shells" that
       you don't see running.

       FORGET PASSPHRASE - wipes the phrase from the environment

       DON'T SHOW PASSPHRASE WHILE TYPING - toggles between showing
       and not showing the passphrase  in plain text- If you type real bad you might
       want to click this every time. Default is ALWAYS set to DON'T.

       ERASE PASSPHRASE - just a handy button to erase the text in the 
       box, it doesn't set or forget anything, just use it to erase
       the text if you suspect you goofed your typing job up.

       ABOUT - just an ad.

       CANCEL - what it says.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Understanding the MASTER environment:

       When PassPhrase is started and your passphrase is set, any DOS
       session ALREADY running will NOT be updated - that's because
       that session gets a copy of the MASTER environment only when 
       the secondary command processor (command.com) starts.  You can 
       check the function of PassPhrase by starting a windowed DOS 
       session and typing SET at the command line. Note that unless 
       you already SET the PGPPASS variable in the config.sys / 
       autoexec.bat or with PassPhrase there should be NO listing for 
       PGPPASS in the variables shown. Exit THAT DOS session and run 
       PassPhrase and set the phrase, then start ANOTHER DOS session. 
       Type SET and you will now notice that one of the variables shown
       will be your PGP pass phrase (or whatever goofy text you typed in)
       in back of the word PGPPASS=.

       You can click the FORGET PASSPHRASE  button on PassPhrase and it
       effectively wipes out the variable, neat huh?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security issues:

       After all that's what PGP is all about isn't it? PassPhrase does
       NOT store your passphrase anywhere on disk or internally to itself,
       it merely sets the environmental variable and exits.  There is 
       some risk though.  Windows is notorious for writing things in 
       the swap file or tmp files, while nothing about PassPhrase does 
       this in and of itself, Windows might take a hankering to write 
       down this juicy bit of info somewhere.  To combat this (which may
       very well be a risk using ANY PGP Windows shell), you need to 
       either use an Empty Cluster disk wiper or Swap File wiper, there
       are tons to choose from and I'll leave it up to you as to which 
       to choose.  I use ZAPUTILS, you'll have to look around the 
       Internet for it. The risk is slight and typically is not much
       of a threat but you have to decide what level of risk to accept.

       PassPhrase does NOT display your passphrase in plain text - asterisks
       are shown, unless you click the SHOW button.  You can check the 
       passphrase by running a DOS session and typing SET and seeing what
       it says.

       Remember when leaving your running PC unattended for a while to WIPE 
       your passphrase by clicking the FORGET PASSPHRASE button, but remember
       the swap file issue and the fact that ANY DOS session started AFTER
       setting your passphrase and left running even after clicking FORGET
       PASSPHRASE still has the variable set in it. So if you saunter 
       away and some evil spy lurks up and types SET in that still running 
       DOS session, you're sunk. Also some PGP SHELL apps might KEEP the
       variable if left running, even with the DOS variable wiped.
       If you are THAT concerned over security, exit Win 95 and restart 
       the PC when you step away, either that or tie a Doberman to the 
       keyboard :)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 Potential problems:

       You might not have enough environmental area.  This is a DOS
       problem and shouldn't really crop up to often. It might if you 
       use like a 500 letter passphrase.  If some error
       pops up saying OUT OF ENVORONMENT or it plain don't work try
       boosting the environmental areas size.  Do this in the config.sys
       with a line something like:

       shell=c:\command.com c:\ e:### /p

       Don't put the line in if it's already there!
       The ### is some number, try 512 if no number is present, if it
       still doesn't work try 768, 1024 or 2048.  Note that the DOS 7.0 
       version of command.com (the one that comes with Win 95) needs to
       be in whatever directory you point to with the shell= statement.

       Your Windows shell might not accept the PGPPASS variable.  I 
       tested this with PGPClick (which is a GREAT shell) and Aegis Shell
       and it worked fine, maybe your shell doesn't accept it, I can't 
       do anything about that, just use one that does. Or maybe you
       have to TELL the shell to use the variable with some setting 
       somewhere on it's menus, like they say RTFM.
       
       No winset.exe available.  Beg borrow or steal one.  It's on the
       Win 95 upgrade CD ROM, I don't know about diskettes (the 3.5"
       disk install of Win 95 sucks anyway, get a CD ROM :) ) I guess they
       have it at the MS website too, I think it's called ENVAR.EXE 
       there.

       If you don't use some sort of Windows unZipper the long file 
       name on PassPhrase.exe may be truncated, no sweat, just use
       Explorer or File manager to rename it to PassPhrase.exe.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

You may not think this app is worth even a dollar, well maybe it
isn't so don't fret about it. If you like it you can show your appreciation
by sending a dollar to me. No bombs, timers or anything to nag you,
just your  guilty conscience about a poor starving guy here hunched over 
his keyboard worrying about where his next meal is coming from, he 
checks the mail daily just waiting to hear from you and send that ONE 
LOUSY STINKING GREENBACK THAT YOU'LL NEVER EVEN MISS ANYHOW to him. But 
don't let all that sway your decision. Nope, keep your lousy old money. :)

At least visit my web page and send me email you tight wad ! :)

