<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000099">
Package: gnome-disk-utility
<br>
Version: 3.22.1-1
<br>
Severity: important
<br>
Tags: security
<br>
X-Debbugs-CC: <a class="moz-txt-link-abbreviated" href="mailto:secure-testing-team@lists.alioth.debian.org">secure-testing-team@lists.alioth.debian.org</a>
<br>
<br>
--- Please enter the report below this line. ---
<br>
<p>Hi and thanks for your work,</p>
<p>If one configure gnome disks to automount LUKS partition
(encryption options, désactivating automatic encryption options,
selecting unlock on start, entering the passphrase in the filed
below) the passphrase ends up in cleartext in a file on
/etc/luks-keys/luks-UUID-OF-PARTITION<br>
</p>
<p>In my opinion this is bad because it makes it easy to recover.
This makes the encryption itself useless and mislead the user into
thinking that his data is secured.<br>
</p>
<p>- Ideally my suggestion would be that the password should go
through the default password keyring software, and the partition
should be mounted at user level.<br>
- If this is not possible I suggest removing the auto-mount
option.<br>
- At the very least I think that the user should be informed of
this issue when he activates that functionality.</p>
<p>Thanks,</p>
<p>Jean-Louis Biasini<br>
</p>
<p>--- System information. ---
<br>
</p>
Architecture: <br>
Kernel: Linux 4.9.0-8-amd64
<br>
<br>
Debian Release: 9.6
<br>
500 stable-updates <a class="moz-txt-link-abbreviated" href="ftp://ftp.fr.debian.org">ftp.fr.debian.org</a> <br>
500 stable security.debian.org <br>
500 stable <a class="moz-txt-link-abbreviated" href="ftp://ftp.fr.debian.org">ftp.fr.debian.org</a> <br>
<br>
--- Package information. ---
<br>
Depends (Version) | Installed
<br>
====================================================-+-=========================
<br>
udisks2 (>= 2.1.1) | 2.1.8-1
<br>
dconf-gsettings-backend | 0.26.0-2+b1
<br>
OR gsettings-backend | <br>
libatk1.0-0 (>= 1.12.4) | 2.22.0-1
<br>
libc6 (>= 2.10) | <br>
libcairo-gobject2 (>= 1.10.0) | <br>
libcairo2 (>= 1.2.4) | <br>
libcanberra-gtk3-0 (>= 0.25) | <br>
libcanberra0 (>= 0.2) | <br>
libdvdread4 (>= 4.1.3) | <br>
libgdk-pixbuf2.0-0 (>= 2.22.0) | <br>
libglib2.0-0 (>= 2.39.90) | <br>
libgtk-3-0 (>= 3.16.2) | <br>
liblzma5 (>= 5.1.1alpha+20120614) | <br>
libnotify4 (>= 0.7.0) | <br>
libpango-1.0-0 (>= 1.18.0) | <br>
libpangocairo-1.0-0 (>= 1.14.0) | <br>
libpwquality1 (>= 1.1.0) | <br>
libsecret-1-0 (>= 0.7) | <br>
libsystemd0 (>= 209) | <br>
libudisks2-0 (>= 2.1.1) | <br>
libx11-6 | <br>
<br>
<br>
Package's Recommends field is empty.
<br>
<br>
Package's Suggests field is empty.
</body>
</html>