On 12/18/2017 09:08 PM, Felix Geyer wrote:
On Mon, 18 Dec 2017 18:04:19 +0100 Heinrich Schuchardt <xypron.g...@gmx.de> 
Not encoding the password means that any user application can fetch it
and send it to the internet even if ~/.config is chmod 700.

Can anything be worse?

Well, that's the unfortunate state of security on the Linux desktop (and other 
major desktop OSes).
Largely there is no privilege separation between applications.
They all run in the same context so they can't really keep secrets from each 
Technologies like Flatpak and Snappy are trying to solve this by sandboxing 
applications [0].


[0] https://github.com/flatpak/flatpak/wiki/Sandbox

Storing the password in the KDE wallet manager would mean that the password could only be retrieved when the wallet is open.

This is not perfect security but better than having the password available at all times.

Best regards


pkg-kde-extras mailing list

Reply via email to