Re: pasting a password

Re: pasting a password

[Chong Yidong]

> DW> Login Name: myname
>
> DW> Login Password: {SHA}reallylongsodontaskmetotypeitinbyhandplease
>
> DW> Login URL: http://wiki.debian.org/UserPreferences
>
> The problem is C-y is just read as a raw character there at the
> mini buffer Password: prompt. emacs-w3m-version "1.4.263".
>
> KY> That's what `read-passwd' that is an Emacs function does.  In
> KY> the function definition, the special keys that it handles are
> KY> only C-h, C-u and C-? (see the doc string).

The following patch allows yanking into the password prompt (I haven't
changed the docstring of read-passwd, which needs doing).  What do
people think about the advisability of this?

Note, in particular, that we can detect any key that performs yank or
yank-pop by using `key-binding'---but it works only if the command is a
single-character key sequence.  That's fine for C-y, but fails if the
user has customized `yank' to a two-character sequence.  I don't see any
way around this, though.

Another shortcoming is that the user can no longer enter a literal C-y;
but this may be a negligble problem---currently, the user can't enter
C-u either, since C-u clears the field.


*** trunk/lisp/subr.el.~1.620.~	2008-11-06 01:49:41.000000000 -0500
--- trunk/lisp/subr.el	2008-11-16 00:48:31.000000000 -0500
***************
*** 1818,1838 ****
  		      (setq c (read-char-exclusive nil t))
  		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
  	  (clear-this-command-keys)
! 	  (if (= c ?\C-u)
! 	      (progn
! 		(and (arrayp pass) (clear-string pass))
! 		(setq pass ""))
! 	    (if (and (/= c ?\b) (/= c ?\177))
! 		(let* ((new-char (char-to-string c))
! 		       (new-pass (concat pass new-char)))
! 		  (and (arrayp pass) (clear-string pass))
! 		  (clear-string new-char)
! 		  (setq c ?\0)
! 		  (setq pass new-pass))
! 	      (if (> (length pass) 0)
! 		  (let ((new-pass (substring pass 0 -1)))
! 		    (and (arrayp pass) (clear-string pass))
! 		    (setq pass new-pass))))))
  	(message nil)
  	(or pass default "")))))
  
--- 1818,1845 ----
  		      (setq c (read-char-exclusive nil t))
  		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
  	  (clear-this-command-keys)
! 	  (cond ((= c ?\C-u)
! 		 (and (arrayp pass) (clear-string pass))
! 		 (setq pass ""))
! 		((memq (key-binding (vector c))
! 		       '(yank yank-pop))
! 		 (let ((new-pass (concat pass
! 					 (substring-no-properties
! 					  (current-kill 0)))))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (setq c ?\0)
! 		   (setq pass new-pass)))
! 		((and (/= c ?\b) (/= c ?\177))
! 		 (let* ((new-char (char-to-string c))
! 			(new-pass (concat pass new-char)))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (clear-string new-char)
! 		   (setq c ?\0)
! 		   (setq pass new-pass)))
! 		((> (length pass) 0)
! 		 (let ((new-pass (substring pass 0 -1)))
! 		   (and (arrayp pass) (clear-string pass))
! 		   (setq pass new-pass)))))
  	(message nil)
  	(or pass default "")))))
  

Diff finished.  Sun Nov 16 00:51:53 2008

Re: pasting a password

[Andreas Schwab]

Chong Yidong <cyd@stupidchicken.com> writes:

> --- 1818,1845 ----
>   		      (setq c (read-char-exclusive nil t))
>   		      (and (/= c ?\r) (/= c ?\n) (/= c ?\e)))
>   	  (clear-this-command-keys)
> ! 	  (cond ((= c ?\C-u)
> ! 		 (and (arrayp pass) (clear-string pass))
> ! 		 (setq pass ""))
> ! 		((memq (key-binding (vector c))
> ! 		       '(yank yank-pop))

That does not work for yank-pop since the default binding is not a
single character one.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: pasting a password

[Chong Yidong]

Andreas Schwab <schwab@suse.de> writes:

> That does not work for yank-pop since the default binding is not a
> single character one.

Yeah.  Maybe we should just hardwire C-y to yank into the password
prompt, and leave it at that.

Re: pasting a password

[Stefan Monnier]

> That does not work for yank-pop since the default binding is not a
> single character one.

It's bound to a single-event sequence, namely M-y.  Now, it's true that
in several circumstances, M-y will be turned into ESC y, so it will only
work in some cases and not all (typically it'll work in a GUI but not
in a tty).
I think to do it better, we'll need to use an implementation technique
closer to the one used by isearch.


        Stefan

Re: pasting a password

[jidanni]

Regarding those mile long one-time passwords that we are supposed to
paste into our browsers, etc.:

Some people also wish to paste the password into the box with the
mouse too (middle button). Therefore please roll back all that extra
security, and just do the plain echo asterisks, like firefox or
whatever.

Speaking about M-y. I am a old dog who still types ESC instead of
Meta-key for the M- stuff -- never learned new tricks.

Re: pasting a password

[Chong Yidong]

jidanni@jidanni.org writes:

> Regarding those mile long one-time passwords that we are supposed to
> paste into our browsers, etc.:
>
> Some people also wish to paste the password into the box with the
> mouse too (middle button). Therefore please roll back all that extra
> security, and just do the plain echo asterisks, like firefox or
> whatever.
>
> Speaking about M-y. I am a old dog who still types ESC instead of
> Meta-key for the M- stuff -- never learned new tricks.

I added a C-y binding to read-passwd.  More complicated stuff, such as
allowing mouse pastes, will have to wait for a isearch-like rewrite of
read-passwd, as Stefan said.

(Also, we should probably document the keybindings that can be used to
enter passwords into the Emacs manual.  I'll add a new node for it.)

Re: pasting a password

[Juri Linkov]

>> That does not work for yank-pop since the default binding is not a
>> single character one.
>
> It's bound to a single-event sequence, namely M-y.  Now, it's true that
> in several circumstances, M-y will be turned into ESC y, so it will only
> work in some cases and not all (typically it'll work in a GUI but not
> in a tty).
> I think to do it better, we'll need to use an implementation technique
> closer to the one used by isearch.

It seems this basically means just ripping out the meat of the function
isearch-other-meta-char.

-- 
Juri Linkov
http://www.jurta.org/emacs/

Re: pasting a password

[Stefan Monnier]

> I added a C-y binding to read-passwd.  More complicated stuff, such as
> allowing mouse pastes, will have to wait for a isearch-like rewrite of
> read-passwd, as Stefan said.

How 'bout using a completely different approach: setup a display-table
so that all chars get displayed as *, or else (so that the prompt can
be displayed properly) use an after-change-function to add a `display'
(or composition) property.
I.e. use normal editing, and only cause the display to use *.


        Stefan

Re: pasting a password

[Chong Yidong]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

> How 'bout using a completely different approach: setup a display-table
> so that all chars get displayed as *, or else (so that the prompt can
> be displayed properly) use an after-change-function to add a `display'
> (or composition) property.  I.e. use normal editing, and only cause
> the display to use *.

That would allow you to copy the contents of the password prompt.  My
understanding is that most applications don't allow that (if you
accidentally leave the terminal without pressing enter, someone would be
able to copy what you've typed, paste it somewhere else, and view it in
cleartext).