Authentication dialogs use plain text spoken password with screen-reader

[Charlie Kravetz]

Binary package hint: gnome-system-tools

Maverick 10.10 final version, upgraded from Ubuntu 10.04 on 2010-11-07. If I select System -> Administration -> Users and Groups from the menu, click on Add, a screen is presented to authenticate to modify the system configuration. When the password is entered, it is spoken by Orca screen-reader as plain text letters and characters for anyone present to hear. The password should be echoed as "asterisk" for each number and letter, as it is for the GDM login.

This issue is present in both Ubuntu 10.04 and 10.10.

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: gnome-system-tools 2.32.0-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.35-22.35-generic 2.6.35.4
Uname: Linux 2.6.35-22-generic i686
NonfreeKernelModules: nvidia
Architecture: i386
Date: Sun Nov 7 13:52:25 2010
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release i386 (20100429)
ProcEnviron:
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: gnome-system-tools

[Marc Deslauriers (mdeslaur)]

Thanks for reporting this issue. Do any other policykit dialogs echo your password?

[Milan Bouchet-Valat (nalimilan)]

users-admin knows nothing about this authentication dialog, it's run by PolicyKit-gnome. So the bug must affect all dialogs.

You should report this to upstream if you really want it to be fixed.

[Charlie Kravetz (cjkgeek)]

The above is incorrect. If I use gksu nautilus, the password is spoken as asterisks, if I use sudo in a terminal, the password is asterisks, if I login, the password is asterisks. If I run update-manager, the password is asterisks. The only instance I have found that echoes the password in clear language is the Users and Groups.

[Milan Bouchet-Valat (nalimilan)]

None of the examples you cite are using PolicyKit actually. Try setting a system connection using NetworkManager config tool for example, or installing packages using updates-manager.

[Charlie Kravetz (cjkgeek)]

If I run update-manager, the password is asterisks. That is, updating using update-manager.

[Milan Bouchet-Valat (nalimilan)]

Weird. Both use PolicyKit. What if you run
export PID=`pidof gnome-settings-daemon`
pkcheck --action-id org.debian.apt.upgrade-packages --allow-user-interaction --process $PID
pkcheck --action-id org.freedesktop.systemtoolsbackends.set --allow-user-interaction --process $PID

Is there a difference between the two dialogs?

[Charlie Kravetz (cjkgeek)]

The password echoed as asterisk, the reponses are the same except the last character:

pkcheck --action-id org.debian.apt.upgrade-packages --allow-user-interaction --process $PID

response:
polkit/56temporary_authorization_id=tmpauthz0

pkcheck --action-id org.freedesktop.systemtoolsbackends.set --allow-user-interaction --process $PID

response:
polkit/56temporary_authorization_id=tmpauthz1

Both require authentication, both echo the password as asterisk.

[Milan Bouchet-Valat (nalimilan)]

And you can swear me the dialog from users-admin is not behaving the same as others?! The only thing users-admin does is asking the backends (so it doesn't even do it by itself) to ask PolicyKit1 to authenticate by whatever means are adequate. So this amounts to "pkcheck --action-id org.freedesktop.systemtoolsbackends.set".

Could you run 'xprop' for each authentication dialog and check that WM_CLASS and _NET_WM_PID are the same for all of them?

[Charlie Kravetz (cjkgeek)]

You have to explain how to do this now. I can tell you the people in the room repeated my password back to me when authenticating Users and Groups. The rest of the passwords were "asterisk asterisk asterisk" and that got repeated too.

[Milan Bouchet-Valat (nalimilan)]

Explain what exactly? xprop is easy, just run 'xprop' and click on the offending dialog to get the results on the console.

[Charlie Kravetz (cjkgeek)]

I do not see any difference between the two dialogs. I ran both Users and Groups authentication and Update-manager authentication. Results of xprop for both windows are:

WM_CLASS(STRING) = "polkit-gnome-authentication-agent-1", "Polkit-gnome-authentication-agent-1"

_NET_WM_PID(CARDINAL) = 1289

I am attaching both results as separate files.

[Milan Bouchet-Valat (nalimilan)]

So these dialogs are indeed the same, from the same process, which is what I expected. I really can't tell why Orca would treat them differently... One would need to know how this works, and what may happen in polkit-gnome-authentication-agent-1 that would change Orca's behavior. But I can't help in that regard! I think you should find an a11y developer on IRC and ask him.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. natty has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against natty is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.