I'm not sure that this is good because if you were to walk away from your computer and forget to lock it someone could keep using your passphrase indefinitely as long as they used it once every X minutes.

I don't think that's much of a security problem. Firstly someone has physical access to your machine, which usually means game over for security. Secondly as far as I can see in the current version of seahorse, someone can change the passphrase settings so that key *don't* expire. so even now if you expire keys after 5 minutes, someone can effectily access them forever. Thirdly this should be an additional option, so you don't have to use it.

Looking at the code, I don't believe that changing the expiration time extends the cache until the key is re-cached.  Stef please correct me if I'm wrong.  On the other hand perhaps the cache should be immediately cleared like when no caching is set.  Although this exposes bug 443561 in that the agent doesn't respond to gconf keys updating.  Also if seahorse-agent is properly tied into your session initialization you can't run it with --no-daemonize as a work around.  I'll make a note of it in that bug.

(In reply to comment #3)
>  bug 443561 

Make that bug 384781.

Yeah Adam, you're right. Or at least that's how I wrote the code, so I hope you're right :) And I think every use of the password renews the password, just like Rory is requesting.

Closing as this seems to be the current behavior.  Rory if you've observed this isn't how things work, please reopen the bug with some timing data we can use to replicate.