Bug#501812: gnome-keyring: Disable graphical dialog when interacting with a shell

Yury Arkady Sobolev yury at ocf.berkeley.edu
Wed Mar 25 06:36:40 UTC 2009


I apologize for barging in on this bug. However, I believe some very
important points are not being addressed.

Following the instructions in [1] has no effect. Although, I suppose
that is an entirely different bug. As far as I can tell, the only way to
disable the functionality is to move the executable out of the way. This
is inelegant.

There is a large nuisance as well. When the program tries to emulate an
agent, it tries to be clever and attempts to unlock every key in the
.ssh directory until it finds one that works. This leads to either the
user being forced to move his or her keys, having to click deny
every time, or accepting ssh keys into the login keyring.

There is a very real security issue here that is being brushed aside.
The layout of the dialog and the fact that it pops up everytime in an
obtrusive manner encourages the user to load SSH keys into the login
keyring. This poses a very strong security risk for users who are not
used to locking their screens when they walk away from their computer.
Given the large number of new users in the Linux community, this is a
concern. Having to enter a passphrase in order to unlock a key is a good
habit. It reminds the user that there *is* a key that *is* being
unlocked. If this is done automatically, it _nearly_ defeats the purpose
of having a passphrase in the first place.

-Yury

[1] /usr/share/doc/gnome-keyring/README.Debian







More information about the pkg-gnome-maintainers mailing list