After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 701965 - Seahorse changes PGP private key passphrase without asking for confirmation
Seahorse changes PGP private key passphrase without asking for confirmation
Status: RESOLVED OBSOLETE
Product: seahorse
Classification: Applications
Component: general
3.4.x
Other Linux
: Normal major
: ---
Assigned To: Seahorse Maintainer
Seahorse Maintainer
Depends on:
Blocks:
 
 
Reported: 2013-06-10 22:44 UTC by axx
Modified: 2018-08-03 19:26 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
gfg (397 bytes, text/plain)
2017-06-22 12:03 UTC, SEKPE Komlan 		Details

Description axx 2013-06-10 22:44:38 UTC 
Using the function to change one's private PGP key's passphrase, Seahorse will first prompt for the current passphrase to be entered, to verify the person's identity, but will then only ask the new passphrase once, not twice as would be expected and reasonable.

Thus, if the user makes but a single typo, they will lose control of their private key. Furthermore, the new passphrase entered is masked when typed, so the user is likeley to not even see they have mistyped.

Before changing the passphrase, Seahorse should warn users to keep backups of their keys in a safe place.
While changing it it should clearly ask the user to retype their passphrase, to guard against any typos or mistakes.
Comment 1 axx 2013-06-10 22:51:17 UTC 
Also, after checking, gpg itself requires the user to first type their current passphrase, then their new passphrase twice and *then* asks for confirmation to save changes.
Comment 2 SEKPE Komlan 2017-06-22 12:03:32 UTC 
Created attachment 354245 [details]
gfg
Comment 3 GNOME Infrastructure Team 2018-08-03 19:26:40 UTC 
-- GitLab Migration Automatic Message --

This bug has been migrated to GNOME's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/seahorse/issues/79.