All the password management is handled by gpg-agent, which can be set to time-out your credentials after X seconds, on screen lock, when a bluetooth device moves out of proximity, or when it senses a disturbance in the force, as if millions of Macintosh users suddenly cried out in terror, and were suddenly silenced.
Gpg-agent is super awesome and flexible. Google it -- you'll dig it.
Yes, gpg-agent is super fancy, and if you and I weren't talking about the joys of "simplicity," I can see how it could be quite useful. (And thanks for pointing it out. If my needs get fancier, I might well decide to use it.)
But, for the moment, we ARE talking about simplicity. I'd like to simply encrypt a plaintext file. Then I'd have a decrypting version of cat (call it "dcat") that asks me for a password, doesn't echo it, and applies it to the file before cat'ing. It doesn't know if the password is right or wrong; it just passes the file through it before cat'ing. If I give it the wrong password, gibberish comes out.
I could then view a whole file (dcat my_secret_pancake_recipe.txt) or pipe it to grep (dcat my_logins.txt | grep -A 2 Netflix) to get just the lines I want---exactly what you'd do with any text file except that it starts with a decryption that asks for a password (which it doesn't echo).
What's the best way to do something this simple?
UPDATE: openssl essentially does this and comes already installed on Mac OS X. I'm a crypto noob, though, so I'd still welcome advice.
But GPG in general is the de facto unix way to go about crypting things. Straight up openssl is good for somethings, making little shell scripts like "dcat" is nice for others, but for general purpose encryption of files, nothing really beats GPG.
I guess GPG isn't simple. It's a big project, well-vetted, and has been under development for years. The usage of its tools, though, is very simple, and the file formats have now become an acceptable standard, widely adopted all over.
So really, give GPG another shot and a close look before you knock it. If it still doesn't meet what you're looking for, check out the man page for openssl-enc. Probably what you want is something like "openssl enc -aes-256-ofb -in infile -out outfile -salt", but likely there are other nuances to account for too. Be careful with crypto.
Gpg-agent is super awesome and flexible. Google it -- you'll dig it.