touch-packages team mailing list archive

[Olivier Tilloy <olivier.tilloy@xxxxxxxxxxxxx>]

> Other apps, such as the "Document Viewer" seem to be perfectly able to
> see the local filesystem...

Document Viewer is only allowed to see files under $HOME/Documents.


> Same for the terminal app, and any programs started by it

Yes, the terminal app is a special case, and as you’ve probably noticed,
it asks your su password at startup, which should make it really clear
that it has special privileges and is not to be left in everyone’s
hands.


> Why not *make* it an exception?

Because that would allow anyone who gets physical access to your phone
to read any file on the FS, including sensitive information, thus
largely invalidating the security model.


> putting passwords in a file:/// would be one way to work around bug #1516220

Another much safer way would be an app that stores those passwords with
strong encryption and a master password. That would make for a nice
addition to the ubuntu app store.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to webbrowser-app in Ubuntu.
https://bugs.launchpad.net/bugs/1516249

Title:
  file:/ URLs not supported

Status in webbrowser-app package in Ubuntu:
  New

Bug description:
  file:/ URLs are not suported (... instead it passes it on to google
  when entered into URL bar, or raises a "network error" when followed
  from a page)

  Being able to browser local html pages would be handy to work around
  bug #1516220 (lack of form completion or password manager), because
  that way could could store pre-filled forms somewhere on your home
  directory.

  Well it is still possible to pull of this workaround, but it requires
  installing nginx (... and configuring it correctly to prevent people
  on the same Wifi from snarfing your password-containing templates...)

  phablet@ubuntu-phablet:~/public_html$ lsb_release -rd
  Description:    Ubuntu 15.04
  Release:        15.04
  phablet@ubuntu-phablet:~/public_html$ apt-cache policy webbrowser-app
  webbrowser-app:
    Installed: 0.23+15.04.20151103-0ubuntu1
    Candidate: 0.23+15.04.20151103-0ubuntu1
    Version table:
   *** 0.23+15.04.20151103-0ubuntu1 0
         1001 http://ppa.launchpad.net/ci-train-ppa-service/stable-snapshot/ubuntu/ vivid/main armhf Packages
          100 /var/lib/dpkg/status
       0.23+15.04.20150416-0ubuntu1 0
          500 http://ports.ubuntu.com/ubuntu-ports/ vivid/main armhf Packages

  What I expected to happen:
    Visiting file:/ should show me a directory view of the root directory of the device

  What happened instead:
    The phone passed the string file:/ on to google... D'oh... :-(

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/webbrowser-app/+bug/1516249/+subscriptions