From mboxrd@z Thu Jan  1 00:00:00 1970
From: "pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de>
Subject: bug#35540: Installer displays encrypted partition password entry in
	cleartext
Date: Sat, 4 May 2019 23:06:32 +0200
Message-ID: <20190504210632.i3tyhzisfw6anpyb@pelzflorian.localdomain>
References: <20190503085437.opsw5whdkzmwrbrm@pelzflorian.localdomain>
	<20190503113018.5be80808@scratchpost.org>
	<20190503115024.20787d13@sybil.lepiller.eu>
	<87tvebbq9v.fsf@gnu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Return-path: <bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([209.51.188.92]:43268)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1hN1s9-0006kv-JR
	for bug-guix@gnu.org; Sat, 04 May 2019 17:07:06 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1hN1s6-00081g-Ne
	for bug-guix@gnu.org; Sat, 04 May 2019 17:07:04 -0400
Received: from debbugs.gnu.org ([209.51.188.43]:38906)
	by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)
	(Exim 4.71) (envelope-from <Debian-debbugs@debbugs.gnu.org>)
	id 1hN1s6-00081Z-Jj
	for bug-guix@gnu.org; Sat, 04 May 2019 17:07:02 -0400
Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1hN1s6-0005I6-Dx
	for bug-guix@gnu.org; Sat, 04 May 2019 17:07:02 -0400
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
Resent-Message-ID: <handler.35540.B35540.155700400520313@debbugs.gnu.org>
Content-Disposition: inline
In-Reply-To: <87tvebbq9v.fsf@gnu.org>
List-Id: Bug reports for GNU Guix <bug-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/bug-guix/>
List-Post: <mailto:bug-guix@gnu.org>
List-Help: <mailto:bug-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=subscribe>
Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org
Sender: "bug-Guix" <bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org>
To: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@gnu.org>
Cc: Mathieu Othacehe <m.othacehe@gmail.com>, 35540@debbugs.gnu.org

On Fri, May 03, 2019 at 03:50:52PM +0200, Ludovic Courtès wrote:
> That’s why I think that seeing what you actually type is useful.
> 

Seeing the password is useful, unless someone is shoulder surfing
while you install, which is possible.


> Other options include:
> 
>   1. Hiding the passphrase, but display right above it something like:
> 
>      Keyboard layout: <layout name>
> 
>   2. Adding a checkbox to toggle password visibility.
> 
> #1 is probably not great because it doesn’t help if you don’t know
> precisely the layout.
> 
> #2 would be nice; not sure how to do it, though.
> 
> Ludo’.
> 

#2 would please everybody, but I do not know what widgets Newt
provides for this.  Mathieu, would you know if changing the
visibility with e.g. a checkbox is doable?

Regards,
Florian