desktop-packages team mailing list archive

[Adam Dingle <adam@xxxxxxxxx>]

GNOME is probably not going to fix this - it's not just the GNOME Way.
I'd like to see Ubuntu address this, though.  Today, if I walk up to any
Ubuntu user's unlocked computer I can see any of their passwords in just
a few keystrokes: Super + P + A + S + Enter starts Seahorse, then I can
double click any password I want and click Show Password.  From the
comments above, I can see I'm not alone in being wary of this.

Ubuntu, would you take a patch to require the user to enter their login
password to use the Show Password feature?

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to seahorse in Ubuntu.
https://bugs.launchpad.net/bugs/189774

Title:
  seahorse shows passwords without verification

Status in Seahorse:
  New
Status in seahorse package in Ubuntu:
  Triaged

Bug description:
  Binary package hint: seahorse

  When I log in the first time, I get asked for my password to access
  the wireless network.

  Then any time later I can run seahorse (without authentication) and go
  and look at my wireless password (password tab / passphrase for
  wireless network / properties). It just asks me 'Do you want to allow
  access?' and if I say yes (ie 'Allow Once' or 'Allow Always'), it
  doesn't ask for authentication or anything, it just shows the
  password.

  Isn't this a security problem?

  If I reboot just X with CTRL-ALT-BS and log in again, when I run
  seahorse it asks me for authentication to run it, but after a full
  reboot it doesn't ask for any authentication.

  I have automatic login enabled (so on full reboot I don't need to
  login via the X login window) if that makes any difference.

  Version info:

  distro: hardy alpha 4

  kernel:  2.6.24-5-generic

  seahorse: 2.21.4-0ubuntu2

  gnu-pg: 1.4.6-2ubuntu5

  python-gnupginterface: 0.3.2-9ubuntu1

To manage notifications about this bug go to:
https://bugs.launchpad.net/seahorse/+bug/189774/+subscriptions