Auto-login to ssh when putting the wrong password

Bug #1007507 reported by Federico Vera
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
nautilus (Ubuntu)
Invalid
Low
Unassigned

Bug Description

Save a ssh password on the connect to server windows (as seen on the screenshot).

The efect is that any short (let's say three character long) password entered is translated in the real password and the user is granted access.

This is just plain wrong, if the password is being remembered it should be cristal clear (at least some asteriks on the text field).
Maybe the best solution is to remove the "remember password" option.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: nautilus 1:3.4.2-0ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-24.39-generic 3.2.16
Uname: Linux 3.2.0-24-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.0.1-0ubuntu8
Architecture: amd64
Date: Fri Jun 1 12:44:59 2012
GsettingsChanges:
 org.gnome.nautilus.window-state geometry '825x566+65+24'
 org.gnome.nautilus.window-state sidebar-width 195
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20111129.1)
SourcePackage: nautilus
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Federico Vera (fedevera) wrote :
Revision history for this message
Tyler Hicks (tyhicks) wrote :

Thanks for using Ubuntu and reporting this bug! I've confirmed it in Precise.

I disagree that it is a security bug, as invalid passwords are only accepted if the valid password has previously been saved. I see it as a UI bug around a feature that happens to relate to security (remote login). As a result, I'm removing the security label from this report.

Changed in nautilus (Ubuntu):
importance: Undecided → Low
status: New → Confirmed
security vulnerability: yes → no
visibility: private → public
Revision history for this message
Sebastien Bacher (seb128) wrote :

The dialog described has change since, closing the bug but feel free to report a new ticket if you still have issues in newer versions

Changed in nautilus (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.