keyring dialog is not modal

[Albert Cardona]

Binary package hint: gnome-keyring

My laptop booted. NetworkManager asked to for access to the key ring. I started typing my password, only to look up on the screen and see that a terminal, which was launched as part of my session, CONTAINED MY PASSWORD TYPED IN FULL VIEW. I was going to give a talk. About 35 people read the password.

Houston, we have a problem with modal dialogs here.

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. I have marked it as public so that other developers will be able to work on it. Please feel free to report any other bugs you may find.

[James Stansell (jamesstansell)]

I can confirm this bug (Ubuntu 7.04). Even though it doesn't normally put my password in full view my typing is likely to go where it's not intended which is bad in several ways. I would expect this dialog to grab the keyboard so the typing doesn't go anywhere else (either maliciously or accidentally.) I'm not sure if modal covers that but modal would be an improvement.

The program in question appears to be /usr/lib/gnome-keyring/gnome-keyring-ask

[Sebastien Bacher (seb128)]

Thanks for your bug report. This bug has been reported to the developers of the software. You can track it and make comments here: http://bugzilla.gnome.org/show_bug.cgi?id=460902

[Sebastien Bacher (seb128)]

The bug has been fixed upstream now

[Sebastien Bacher (seb128)]

 gnome-keyring (2.19.6-0ubuntu1) gutsy; urgency=low
 .
   * New upstream version:
     * Grab the keyboard when prompting for passwords, and always put the prompt
       window above other windows.
     * Now supports use of keyrings on removable drives.
     * PAM module to automatically unlock keyrings on login, or unlocking
     * Simplify daemon code (now uses cooperative threading) and get it ready for
       other PKCS#11, SSH and other stuff running in same process.
   * debian/control.in
     * added missing libhal-storage build dependency

[jwm (jwm-angrymonkey)]

The problem with the current keyboard grab implementation is that it prevents the user accessing third party password stores:

* A user can't select another window top copy a password to the clipboard
* The clipboard is either cleared or inaccessible from the password dialog, so a previously selected password cannot be pasted in.

Right now, I have two paths:

* Allow the password store to display passwords to the screen so I can read them while typing (assuming the password dialog box doesn't obscure that part of the screen; it's an immovable window).
* Cancel and hope that the requesting application will let me enter a password by some other means (ie the terminal I'm running it from).