Your message dated Mon, 11 Jan 2016 11:52:23 +0000 with message-id <[email protected]> and subject line Bug#645499: fixed in keepassx 2.0-1 has caused the Debian Bug report #645499, regarding keepassx: Pronounceable password generation is buggy to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 645499: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645499 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: keepassx Version: 0.4.3-1 Severity: important Dear Maintainer, The pronounceable password generator lets the user select which types of characters should be included in the password. However these indications are rarely taken into account. For all the tests below the 'Ensure that password contains characters from every group' checkbox of the 'Random' password generator tab was checked although it should not have any impact on the pronounceable password generator. Still I noticed the following problems: * The most important issue is that, for a length of 25 characters, the generator announces a quality of 118 bits for 'Lower Letters' only passwords, and 129 bits if 'Numbers' are added. However in this configuration only one in ten generated passwords actually have any digit in them. This means 90% of the generated passwords are weaker than announced. Yet the generator could easily work some digits in by performing some l33t substitutions. Maybe the right fix is to add the 'Ensure that password contains characters from every group' checkbox to the pronounceable password generator. * If one selects only 'Numbers' the quality drops to 83 bits which makes sense. But the generated passwords still contain lower case characters as proven by these passwords: hokophelocyolurkeatneybof kedwyibowjackipjodvatniek In fact they may not contain digits at all! (but at least the quality is still more than 83 bits) * Similarly, if one only selects 'Upper Letters' the generated passwords still contain lower case letters, as in this password: AmicWoybogUnyudsyeejyedsa * Again the same thing happens if one selects only 'Special Characters' as shown here: viaryakodd]quifimnidfeurs If the generator always adds lower case letters to the passwords then one should not be able to deselect the 'Lower Letters' checkbox. However these options seem to work fine in the random generator so it would only make sense to make them work in the pronounceable generator too. Note: I tested this in both the fr_FR.utf8 and the C locales. Nitpick: it should also probably be 'digits' rather than 'numbers'. -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (500, 'testing'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.0.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages keepassx depends on: ii libc6 2.13-21 ii libgcc1 1:4.6.1-4 ii libqt4-xml 4:4.7.3-5 ii libqtcore4 4:4.7.3-5 ii libqtgui4 4:4.7.3-5 ii libstdc++6 4.6.1-4 ii libx11-6 2:1.4.4-2 ii libxtst6 2:1.2.0-3 keepassx recommends no packages. keepassx suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: keepassx Source-Version: 2.0-1 We believe that the bug you reported is fixed in the latest version of keepassx, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Reinhard Tartler <[email protected]> (supplier of updated keepassx package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 09 Jan 2016 19:24:30 -0500 Source: keepassx Binary: keepassx Architecture: source Version: 2.0-1 Distribution: unstable Urgency: medium Maintainer: Reinhard Tartler <[email protected]> Changed-By: Reinhard Tartler <[email protected]> Description: keepassx - Cross Platform Password Manager Closes: 645499 685533 707634 714357 763083 791858 Changes: keepassx (2.0-1) unstable; urgency=medium . * New upstream release. (Closes: #707634) - Completely rewritten compared to 0.x series (closes: #707634, #685533, #714357, #763083, #791858) - pronouncable password generator has been dropped (closes: #645499) Checksums-Sha1: 953e73dfcfc250492c562a0dde3b25557011b17c 1720 keepassx_2.0-1.dsc e5dc2e55c9ec22a769abac177f2c3b6dfb0a315c 1524638 keepassx_2.0.orig.tar.gz 166c4f8a63562681d83aa3c55eaf2fc5627a8ba8 9628 keepassx_2.0-1.debian.tar.xz Checksums-Sha256: 195ff6867a3726e07dc0aba24c018dd9e3e366419e8bca7c1ff6d47ba27d7fc9 1720 keepassx_2.0-1.dsc 0eb40fac3a44d8283dfc1ee28cc6de5c660b22ab975472de82c2b04675c822e6 1524638 keepassx_2.0.orig.tar.gz a6661cccfd97f7cf5754d3c2f1316aa63195d8aae4b3201ef362df6c11030252 9628 keepassx_2.0-1.debian.tar.xz Files: 44048d763ec6bb6a88939b824be7982a 1720 utils optional keepassx_2.0-1.dsc ded7db880d07cd1e5f7bd5bf3cc8c0f4 1524638 utils optional keepassx_2.0.orig.tar.gz 868904eb1622c1c4c25e9f9ce4921cfc 9628 utils optional keepassx_2.0-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCAAGBQJWk5PlAAoJEIuAbIZKeKRFNFsMALOJb47mpbA+0WFtsiVlx2D/ Co8587I8k4d+kIfQjil7mPQTG33NCRQMv75LHaNDkv1sVCLxXOJyRRImHl68kDpU BtC02LT6L9GOSIQf6DCpXQiSAss80GxJGFPh3Fumd6OWmYq/HEhkWM/E8yWXxBEp tE8EqpaBIdan6/6kDCaBI0tu64rqwkhU7V9fYfEEPKkC0RtcMrnvrVOtXTFtK5tT aeyKtyn15RB2r5QV9ibH+lgkt4Gw5WmHz8+a6KmnEc8CiljWZvg+vYryDiAenG3C QfneD1AC3PULF9FUI/nP+T9G4LoFQ34+Ji3trANUUwVhYbUr6zqajUlNswX9pBu+ 2RQQ72xfBSZ9NY6/zE6GYMU+XOBSK7IEhfQcXu4c8w2EX4K+bEQKYd4W2dhN188h ODwKLXZTtILxaGJsHSV1dqfR4zyTo9IpgMJwQNrPwYqUOjiIEUIW61+F8JuqJ/0e mDNew7+99/TX4+l/hCHWjs5fUwTxHiclds36CtxRNQ== =zHcd -----END PGP SIGNATURE-----
--- End Message ---
