Separate auth-sources for Tramp and Gnus, or disable auth-sources for Tramp?

You can either use this (I base mine on the command-line arguments):

(setq tzz-gnus-running-p (member "gnus" command-line-args)) (setq auth-sources (if tzz-gnus-running-p '("~/.gnus.json.gpg") '("~/.authinfo.json.gpg"))) 

or customize tramp-completion-use-auth-sources:

tramp-completion-use-auth-sources is a variable defined in ‘tramp.el’. Its value is t ... Whether to use ‘auth-source-search’ for completion of user and host names. 

I had the exact same problem and found the answer in the Emacs documentation after (setq tramp-completion-use-auth-sources nil) didn't work for me. Here is the relevant snippet from the documentation:

In case you do not want to use an authentication file for TRAMP passwords, use connection-local variables like this:

(connection-local-set-profile-variables 'remote-without-auth-sources '((auth-sources . nil))) (connection-local-set-profiles '(:application tramp) 'remote-without-auth-sources) 

This has the expected result of TRAMP prompting for a password in the minibuffer (not authinfo.gpg) when trying to open a file as root - in my case, M-o r after using counsel-find-file.

Note that password-cache-expiry applies to TRAMP, so you can tweak this setting to find a good balance between convenience and security regarding the password prompt frequency.