From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Subject: bug#35540: Installer displays encrypted partition password entry in cleartext Date: Fri, 03 May 2019 15:50:52 +0200 Message-ID: <87tvebbq9v.fsf@gnu.org> References: <20190503085437.opsw5whdkzmwrbrm@pelzflorian.localdomain> <20190503113018.5be80808@scratchpost.org> <20190503115024.20787d13@sybil.lepiller.eu> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([209.51.188.92]:38168) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hMYbb-0003DC-KG for bug-guix@gnu.org; Fri, 03 May 2019 09:52:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hMYba-0001V3-6d for bug-guix@gnu.org; Fri, 03 May 2019 09:52:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:34583) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hMYba-0001Uh-2Y for bug-guix@gnu.org; Fri, 03 May 2019 09:52:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hMYba-00077I-0Z for bug-guix@gnu.org; Fri, 03 May 2019 09:52:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <20190503115024.20787d13@sybil.lepiller.eu> (Julien Lepiller's message of "Fri, 3 May 2019 11:50:24 +0200") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Julien Lepiller Cc: 35540@debbugs.gnu.org Julien Lepiller skribis: > Le Fri, 3 May 2019 11:30:18 +0200, > Danny Milosavljevic a =C3=A9crit : > >> Hi, >>=20 >> On Fri, 3 May 2019 10:54:37 +0200 >> "pelzflorian (Florian Pelz)" wrote: >>=20 >> > When creating an encrypted partition in Manual partitioning (maybe >> > also Guided?) in the Newt installer, it asks for a password with >> > which to encrypt the partition. However only the password >> > confirmation password entry diplays ******* instead of the typed >> > password, the password entry before displays the password in >> > cleartext.=20=20 >>=20 >> Yes. What about it is a bug? It would be very bad if you had a typo >> in the partition encryption password, so it's good that it's visible. >>=20 >> If you want, we can make the password visible in both boxes. >> But we shouldn't make it invisible in both boxes. > > The role of the confirmation is to make sure you didn't make a typo > somewhere. But that=E2=80=99s a different thing. Suppose you type a passphrase assumi= ng you have a Dvorak keyboard but it=E2=80=99s actually QWERTY. You=E2=80=99l= l get the confirmation right. Then when you boot, if for some reason you get the wrong keyboard layout, you=E2=80=99re screwed. That=E2=80=99s why I think that seeing what you actually type is useful. Other options include: 1. Hiding the passphrase, but display right above it something like: Keyboard layout: 2. Adding a checkbox to toggle password visibility. #1 is probably not great because it doesn=E2=80=99t help if you don=E2=80= =99t know precisely the layout. #2 would be nice; not sure how to do it, though. Ludo=E2=80=99.