This forum has been archived. All content is frozen. Please use KDE Discuss instead.

Insecure KWalet behaviour

Tags: None
(comma "," separated)
User avatar
alarm
Registered Member
Posts
8
Karma
0
OS

Insecure KWalet behaviour

Tue Feb 12, 2013 6:52 am
Now, if you don't want to enter a kwallet password each time, you need to leave an empty password.
But, in this case, you can open KWallet manager and see all stored data without entering any password.
In my opinion, it is very insecure.
I found several simular issues in KDE bug tracker and added a comment.
( for example https://bugs.kde.org/show_bug.cgi?id=244232#c1 )
But there are no action in this area of issues. Nobody has answered yet.
So, guys, could you help me? Who is looking on these issues? Why are there a lot of duplicates and unconfirmed bugs?
May be nobody looks on it?
User avatar
bcooksley
Administrator
Posts
19765
Karma
87
OS

Re: Insecure KWalet behaviour

Wed Feb 13, 2013 5:14 am
If you want to have a passworded wallet, I would suggest changing the closing settings of KWallet instead. You can find these at System Settings > Account Details > KDE Wallet. I would suggest unchecking "Close when last application stops using it" and checking either "Close when screensaver starts" or "Close when unused for" (or checking both).


KDE Sysadmin
[img]content/bcooksley_sig.png[/img]
User avatar
alarm
Registered Member
Posts
8
Karma
0
OS

Re: Insecure KWalet behaviour

Thu Feb 21, 2013 5:31 am
bcooksley wrote:If you want to have a passworded wallet, I would suggest changing the closing settings of KWallet instead. You can find these at System Settings > Account Details > KDE Wallet. I would suggest unchecking "Close when last application stops using it" and checking either "Close when screensaver starts" or "Close when unused for" (or checking both).

Thanks for the answer!
But it isn't what I mean. I want, that kwallet will have behaviour like keychain in Mac OS X.
When you login into system and enter your password, keychain opens for application.
All apps, which were given access to keychain earlier would use passwords/certificates etc without any annoying questions.
But you can't add a new application or see wallet data without enter password.
I think it is very good model.

But my post wasn't only about kwallet behavior. I am interesting what happens with these tickets in kde-bugs. For example all ticket with kwalletmanager as product. Sometimes it seems, that nobody checks issues. I don't see any activity in tickets for years. This ticket is assigned by default on Michael Leupold...
May be somebody from KDE developers or managers needs to review these tickets, closed double, leave a comment, etc...
User avatar
bcooksley
Administrator
Posts
19765
Karma
87
OS

Re: Insecure KWalet behaviour

Thu Feb 21, 2013 8:40 am
Unfortunately the current design of KWallet doesn't really allow for easy integration with your system credentials.

I'm not aware of the maintenance state of KWallet at the moment - however do be aware that people tend to work on the areas which interest them - and KDE does not have any managers as such (although bug triagers may occasionally triage bugs for an application).


KDE Sysadmin
[img]content/bcooksley_sig.png[/img]
User avatar
alarm
Registered Member
Posts
8
Karma
0
OS

Re: Insecure KWalet behaviour

Fri Mar 01, 2013 7:07 am
bcooksley wrote:Unfortunately the current design of KWallet doesn't really allow for easy integration with your system credentials.

I'm not aware of the maintenance state of KWallet at the moment - however do be aware that people tend to work on the areas which interest them - and KDE does not have any managers as such (although bug triagers may occasionally triage bugs for an application).

yep. There is a big contrast between this forum, where I can recieve an answer (from you, for example) and with KDE bugtracker, where I can write a new issue, add comments in old threads, but... it seems that nobody cares =(
I understand, that it is an opensource and a lot of developers do what they want. But as far as I know, KDE has some kind of organization, roadmaps, plans for the future. So, somebody needs to make a decision about this.
Anyway, thank you =)


Bookmarks



Who is online

Registered users: bancha, Bing [Bot], Evergrowing, Google [Bot], lockheed, mesutakcan, Sogou [Bot]