[security] update-notifier auto popups maybe spoofed by the webbrowser

[Peter Cooper]

The current Update Notifier opens an unsolicited window, with an expectation that the user should enter his password to perform an update. This could be copied by a malware applet running in Firefox.

e.g. The user is running firefox (or any other web browser), he minimises the browser and finds a look-alike window asking him to perform an update, as part of this process he will need to enter his password. With the current proposals this is an expected activity for the user and he may then do as requested, thus giving away his password.

[Matthew Paul Thomas (mpt)]

I think this bug report is invalid. For several years Web browsers have insisted on showing the address bar, or the status bar, or both, in any popup window as a way of distinguishing it from native application windows. Can you provide a demo which avoids this security measure?

If it was possible to fake the gksudo window in this way it would also be possible to fake the PolicyKit dialog, or Seahorse's Change Password dialog, or the password dialogs from Evolution or Thunderbird or Pidgin or any other program that uses passwords, in exactly the same way. So the problem would still need to be fixed in the Web browser.

[Launchpad Janitor (janitor)]

[Expired for update-notifier (Ubuntu) because there has been no activity for 60 days.]