GNOME Bugzilla – Bug 697668
Password dialogs provide no context about what's requesting a password
Last modified: 2015-07-14 22:39:50 UTC
The gnome-shell password prompt can pop up at any time that a password is required. Sadly, it doesn't provide any information about what the password is going to used for, or what application wants it. Maybe empathy wants my gmail password in order to sign into gtalk. Maybe the StealYourIdentity™ app is trying to get the password for nefarious reasons. I have no idea. But given I don't have that information, I have two choices: - Don't trust any of them, and stop using empathy/evolution/whatever, until I figure out how to update their passwords by some other means - Trust all of them, which (being the most convenient option) is probably the behavior that's going to be reinforced by gnome-shell.
This is an important paper cut issue for users. Without knowing context, it is hard to figure out which application is requesting this, to disable it. I get multiple requests for my gmail account, but where is it coming from if evolution and empathy have been disabled? Is it Online Accounts? Is it some other application? Very bad user experience.
I've run into this a few times myself with my google account. Because I use 2 factor authentication I need to generate an application specific password. But because the prompt is modal I can't create the password and paste it in. And because the dialog doesn't indicate what application is requesting the password (GNOME online accounts? Empathy? Thunderbird?)I can't find where to put it in after the fact.
(In reply to comment #0) > The gnome-shell password prompt can pop up at any time that a password is > required. I think that this is the real bug in this case. Password dialogs should *never* randomly pop in your face - they should always be triggered by an action that you just made. I suspect that you've run into an Evolution bug: sometimes it pops up a password dialog on its own. Have you been able to figure out what was actually causing the dialog? That said, I agree that we should indicate which application is wanting a password, but I think it makes sense to tackle this when we get into application sandboxing territory.
I believe it's Online Accounts and Google Services. This can expire (with no notice to user). So the password dialog could be from services that call it. I tried disabling all mail/contact checks in Evolution and it still pops-up. Only when reauthenticating does it work. Furthermore the authentication can be two-pass so the password dialog will never work.
For the record Kamil Paral reported running into this in #fedora-desktop today: <kparal> folks, could somebody please tell me which application is responsible for this dialog? https://dl.dropboxusercontent.com/u/839209/gnome-password.png <kparal> I don't want to give my password to "someone", I want to know who I'm giving it to. Evolution works OK and GOA don't complain either. I have no idea what other application can be responsible for this dialog. Why is there no app identifier? <kparal> and it displays again and again after every log in and then each 30 minutes or something like that I believe he'd likely be running 3.10, 3.12 or 3.13.
(In reply to comment #5) > For the record Kamil Paral reported running into this in #fedora-desktop today: > > <kparal> folks, could somebody please tell me which application is responsible > for this dialog? https://dl.dropboxusercontent.com/u/839209/gnome-password.png I re-uploaded it here: http://i.imgur.com/XI8G0lf.jpg > > <kparal> I don't want to give my password to "someone", I want to know who I'm > giving it to. Evolution works OK and GOA don't complain either. I have no idea > what other application can be responsible for this dialog. Why is there no app > identifier? After trial and error, I found out that it was caused by Google account in GNOME Online Accounts, by Calendar slider. No matter what password I used (general google password or custom application password), it rejected it as invalid. So I decided to remove Google account from GOA and add it back again. It was removed successfully, but clicking on Add Online Account button does nothing. So this problem was "solved" for me - I no longer have my account in GOA. > > <kparal> and it displays again and again after every log in and then each 30 > minutes or something like that > > I believe he'd likely be running 3.10, 3.12 or 3.13. 3.10 Someone with sufficient permissions should change the Version of this bug, and also change it to more appropriate state than NEEDINFO - it seems we don't need to wait for any more information.
kamil: well, the journalctl output might help figure out what's going wrong with GOA, I guess.
(In reply to comment #7) > kamil: well, the journalctl output might help figure out what's going wrong > with GOA, I guess. Yeah. I haven't seen anything useful there, but I'll try to debug it soon and then report it as a separate issue.
*** This bug has been marked as a duplicate of bug 688351 ***