What are the risks of using GnuPG 1.4.9 with the insecure memory message?

Question

I have Cygwin installed on several computers and would like to use the included GnuPG to encrypt files for my use only. The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

Answer 1

The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

It's always a good idea to use the latest version, especially with security-critical SW such as encryption. However, GnuPG 1.x and 2.x are being maintained in parallel, and the latest version from the 1.x series is 1.4.11, so you are not that far out of date. The changelogs for 1.4.10 and 1.4.11 do not mention any security fixes, so you are probably OK.

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

Yes, precisely. If you are the only person using your computer, and if you are not worried about an attacker with physical access to your hardware, you can ignore the warning. You can disable it, see the GnuPG FAQ.