network manager shows passwords without verification

Bug #742228 reported by Elias K Gardner
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
network-manager-applet (Ubuntu)
Confirmed
Low
Unassigned

Bug Description

To Reproduce:
1) click network-manager-gnome icon and select "Edit Connections..."
2) Select a connection with a password and click "Edit"
3) Under the "Wireless Security" tab check "Show Password" to see the connection's password in plain text.

Network Manager should prompt for the user login password before showing the network connection's password.

Note this same behavior is in Passwords and Encryption Keys (seahorse) see Bug #189774

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: network-manager-gnome 0.8.4~git.20110318t152954.9c4c9a0-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.38-7.38-generic 2.6.38
Uname: Linux 2.6.38-7-generic x86_64
Architecture: amd64
CRDA: Error: [Errno 2] No such file or directory
Date: Thu Mar 24 23:41:56 2011
EcryptfsInUse: Yes
IfupdownConfig:
 auto lo
 iface lo inet loopback
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20110302)
IpRoute:
 192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.16 metric 2
 169.254.0.0/16 dev wlan0 scope link metric 1000
 default via 192.168.1.1 dev wlan0 proto static
NetworkManager.state:
 [main]
 NetworkingEnabled=true
 WirelessEnabled=true
 WWANEnabled=true
ProcEnviron:
 LANGUAGE=en_US:en
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: network-manager-applet
UpgradeStatus: Upgraded to natty on 2011-03-22 (2 days ago)

Revision history for this message
Elias K Gardner (zorkerz) wrote :
Revision history for this message
Mathieu Trudel-Lapierre (cyphermox) wrote :

This has been brought up on the NM mailing list:

http://mail.gnome.org/archives/networkmanager-list/2011-March/msg00208.html

As I expressed in my response, I don't think this is the answer as there is no way to know the user connected to the session isn't the one who created the connection (and thus would know the password anyway). Connections set "Available to all users" would be owned by root and already request the user password before opening for edition.

Since there's no decision made yet by the upstream developers, I'll mark this bug Confirmed, Low priority (because there are workarounds).

Changed in network-manager-applet (Ubuntu):
status: New → Confirmed
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.