safety

[Joachim Backes]

On 01/18/17 15:51, Patrick Dupre wrote:
>  Hello,
>
>  When you log from the graphics interface (gnome) and provide the
>  password, if the system is slow (long response time), then the
>  password can appear in clear !!! 
Hi Patrick,

having the same issue if booting into runlevel 3 and then login:
if I'm too fast with entering the password after having entered the 
username, then the password can be seen until the password prompt 
appears :-(

Kind regards

Joachim Backes

>  This my be annoying!
>
>
>  ===========================================================================
>  Patrick DUPRÉ | | email: pdupre(a)gmx.com
>  Laboratoire de Physico-Chimie de l'Atmosphère | |
>  Université du Littoral-Côte d'Opale | |
>  Tel. (33)-(0)3 28 23 76 12 | | Fax: [phone]
>  189A, avenue Maurice Schumann | | 59140 Dunkerque, France
>  ===========================================================================
>
>
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  

-- 

Fedora release 25 (Twenty Five)
Kernel-4.9.4-201.fc25.x86_64


Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;
https://www-user.rhrk.uni-kl.de/~backes/

[Rick Stevens]

On 01/18/2017 08:25 AM, Joachim Backes wrote:
>  On 01/18/17 15:51, Patrick Dupre wrote:
> > Hello,
> >
> > When you log from the graphics interface (gnome) and provide the
> > password, if the system is slow (long response time), then the
> > password can appear in clear !!!
>  
>  Hi Patrick,
>  
>  having the same issue if booting into runlevel 3 and then login:
>  if I'm too fast with entering the password after having entered the
>  username, then the password can be seen until the password prompt
>  appears :-( 
That's normal. The system (or shell) is echoing the input because the
program you expect to consume the input isn't running or hasn't
finished initializing yet. What do you expect the system to do? Not
echo anything unless explicitly told to?
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    ricks(a)alldigital.com -
- AIM/Skype: therps2        ICQ: 226437340           Yahoo: origrps2 -
-                                                                    -
-   Never test for an error condition you don't know how to handle.  -
----------------------------------------------------------------------

[Tom Rivers]

On 1/18/2017 12:24 PM, Rick Stevens wrote:
>  That's normal. The system (or shell) is echoing the input because
> the
>  program you expect to consume the input isn't running or hasn't
>  finished initializing yet. What do you expect the system to do? Not
>  echo anything unless explicitly told to? 
Perhaps I'm missing something here, but the answer to this dilemma seems 
to be as simple as don't ask for a password until you are ready to 
ensure it is handled properly.  More to the point, if the place on the 
display where a password is supposed to be entered is not shown, then a 
user won't be tempted to enter it.  The fact a password field is 
displayed should mean that the system is ready to deal with it 
appropriately.  Otherwise we can potentially get a "cart before the 
horse" situation like this one.


Tom

[Rick Stevens]

On 01/18/2017 10:09 AM, Tom Rivers wrote:
>  On 1/18/2017 12:24 PM, Rick Stevens wrote:
> > That's normal. The system (or shell) is echoing the input because the
> > program you expect to consume the input isn't running or hasn't
> > finished initializing yet. What do you expect the system to do? Not
> > echo anything unless explicitly told to?
>  
>  Perhaps I'm missing something here, but the answer to this dilemma seems
>  to be as simple as don't ask for a password until you are ready to
>  ensure it is handled properly.  More to the point, if the place on the
>  display where a password is supposed to be entered is not shown, then a
>  user won't be tempted to enter it.  The fact a password field is
>  displayed should mean that the system is ready to deal with it
>  appropriately.  Otherwise we can potentially get a "cart before the
>  horse" situation like this one. 
That's not what's happening here. The user is starting a program, then
immediately typing in the expected password before the program starts,
essentially making use of the type-ahead capability of the shell.
The program hasn't, well, "registered" its stdin yet so the data is
echoed to the screen as there's no where else for it to go. There is no
way for the shell to know it shouldn't echo the data. The only way I
can see for this to not happen is to disable type-ahead in the shell.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital    ricks(a)alldigital.com -
- AIM/Skype: therps2        ICQ: 226437340           Yahoo: origrps2 -
-                                                                    -
-"Jimmie crack corn and I don't care." What kind of a lousy attitude -
-                 is THAT to have, huh?   -- Dennis Miller           -
----------------------------------------------------------------------

[Tom Rivers]

On 1/18/2017 1:25 PM, Rick Stevens wrote:
>  That's not what's happening here. The user is starting a
> program, then
>  immediately typing in the expected password before the program starts,
>  essentially making use of the type-ahead capability of the shell.
>  The program hasn't, well, "registered" its stdin yet so the data is
>  echoed to the screen as there's no where else for it to go. There is no
>  way for the shell to know it shouldn't echo the data. The only way I
>  can see for this to not happen is to disable type-ahead in the shell. 
Sorry, I should have been more specific because I agree with what you 
just said - there's not a whole lot that can be done about that.  
However, my previous comments were directed at the situation the OP 
identified:

On 1/18/2017 9:51 AM, Patrick Dupre wrote:
>  Hello,
>
>  When you log from the graphics interface (gnome) and provide the
>  password, if the system is slow (long response time), then the
>  password can appear in clear !!!
>  
With respect to Gnome, I would suspect that there is a way to ensure 
that the prompt for password is only displayed when the system is ready 
to handle it properly.


Tom