[Touch-packages] [Bug 1366314] Re: security issue? auto suggest seems to copy credentials into clipboard
*** This bug is a duplicate of bug 1361732 *** https://bugs.launchpad.net/bugs/1361732 ** Tags added: touch-2014-09-11 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyboard in Ubuntu. https://bugs.launchpad.net/bugs/1366314 Title: security issue? auto suggest seems to copy credentials into clipboard Status in “ubuntu-keyboard” package in Ubuntu: New Bug description: on todays image (krillin rtm-proposed r21) with ONLY auto suggest language option on I get: 13:57 asac 1. kill terminal 13:57 asac 2. open terminal and enter pin 13:57 asac 3. click in terminal pastes my pin :) obviously not good for security. Think might be bad. Seems its not getting to dictionary at least: 13:58 asac 4. /me uses backspace to delete 13:58 asac 5. type ls 13:58 asac 6. type first digit of pin - does not suggest my pin This doesn't happen if I turn auto suggestion off. Not sure if the paste is what doesn't happen or the clipboarding doesn't happen. Surely important to check out and know for sure. We should check other credential prompts too: pin lock screen, sim pin etc. Haven't tried, but I assume UITK password fields and browser dont have that, but might be worth checking. Thanks! To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-keyboard/+bug/1366314/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1366314] Re: security issue? auto suggest seems to copy credentials into clipboard
It does seem that the keyboard shouldn't be putting whatever you type into the clipboard. That said, I wonder if this is also a bug in the terminal app? Maybe it isn't using these: Qt.ImhHiddenText - Characters should be hidden, as is typically used when entering passwords. This is automatically set when setting echoMode to TextInput.Password. Qt.ImhSensitiveData - Typed text should not be stored by the active input method in any persistent storage like predictive user dictionary. Note, AIUI, the filemanager app uses the same embedded password checking backend as the terminal so it may be affected too. Reference: http://people.canonical.com/~dpm/sdk-docs/html.orig/qml-ubuntu-components0-textfield.html -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyboard in Ubuntu. https://bugs.launchpad.net/bugs/1366314 Title: security issue? auto suggest seems to copy credentials into clipboard Status in “ubuntu-keyboard” package in Ubuntu: New Bug description: on todays image (krillin rtm-proposed r21) with ONLY auto suggest language option on I get: 13:57 asac 1. kill terminal 13:57 asac 2. open terminal and enter pin 13:57 asac 3. click in terminal pastes my pin :) obviously not good for security. Think might be bad. Seems its not getting to dictionary at least: 13:58 asac 4. /me uses backspace to delete 13:58 asac 5. type ls 13:58 asac 6. type first digit of pin - does not suggest my pin This doesn't happen if I turn auto suggestion off. Not sure if the paste is what doesn't happen or the clipboarding doesn't happen. Surely important to check out and know for sure. We should check other credential prompts too: pin lock screen, sim pin etc. Haven't tried, but I assume UITK password fields and browser dont have that, but might be worth checking. Thanks! To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-keyboard/+bug/1366314/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1366314] Re: security issue? auto suggest seems to copy credentials into clipboard
*** This bug is a duplicate of bug 1361732 *** https://bugs.launchpad.net/bugs/1361732 ** This bug has been marked a duplicate of bug 1361732 predictive keyboard pastes text across focus changes -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyboard in Ubuntu. https://bugs.launchpad.net/bugs/1366314 Title: security issue? auto suggest seems to copy credentials into clipboard Status in “ubuntu-keyboard” package in Ubuntu: New Bug description: on todays image (krillin rtm-proposed r21) with ONLY auto suggest language option on I get: 13:57 asac 1. kill terminal 13:57 asac 2. open terminal and enter pin 13:57 asac 3. click in terminal pastes my pin :) obviously not good for security. Think might be bad. Seems its not getting to dictionary at least: 13:58 asac 4. /me uses backspace to delete 13:58 asac 5. type ls 13:58 asac 6. type first digit of pin - does not suggest my pin This doesn't happen if I turn auto suggestion off. Not sure if the paste is what doesn't happen or the clipboarding doesn't happen. Surely important to check out and know for sure. We should check other credential prompts too: pin lock screen, sim pin etc. Haven't tried, but I assume UITK password fields and browser dont have that, but might be worth checking. Thanks! To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-keyboard/+bug/1366314/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1366314] Re: security issue? auto suggest seems to copy credentials into clipboard
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyboard in Ubuntu. https://bugs.launchpad.net/bugs/1366314 Title: security issue? auto suggest seems to copy credentials into clipboard Status in “ubuntu-keyboard” package in Ubuntu: New Bug description: on todays image (krillin rtm-proposed r21) with ONLY auto suggest language option on I get: 13:57 asac 1. kill terminal 13:57 asac 2. open terminal and enter pin 13:57 asac 3. click in terminal pastes my pin :) obviously not good for security. Think might be bad. Seems its not getting to dictionary at least: 13:58 asac 4. /me uses backspace to delete 13:58 asac 5. type ls 13:58 asac 6. type first digit of pin - does not suggest my pin This doesn't happen if I turn auto suggestion off. Not sure if the paste is what doesn't happen or the clipboarding doesn't happen. Surely important to check out and know for sure. We should check other credential prompts too: pin lock screen, sim pin etc. Haven't tried, but I assume UITK password fields and browser dont have that, but might be worth checking. Thanks! To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-keyboard/+bug/1366314/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
