This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 185221 - 6.9 Beta tries to access the KDE keyring (KWallet) without further explanation
Summary: 6.9 Beta tries to access the KDE keyring (KWallet) without further explanation
Status: RESOLVED DUPLICATE of bug 181252
Alias: None
Product: platform
Classification: Unclassified
Component: Options&Settings (show other bugs)
Version: 6.x
Hardware: PC Linux
: P3 normal (vote)
Assignee: psychollek
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-29 05:41 UTC by paschelino
Modified: 2010-04-29 14:52 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Exception Reporter: -

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description paschelino 2010-04-29 05:41:32 UTC 
Is this possibly a severe security issue?
Since I installed the 6.9 Beta on my linux box, every nb startup the platform tries to access my KDE keyring! There is no explanation given in the dialog, for what reason this happens. This makes me really feel _unsafe_ with 6.9 since it is not clear if the keyring data is requested by malicious or by trustworthy code!
Comment 1 Antonin Nebuzelsky 2010-04-29 11:41:16 UTC 
Reassigning.

Jesse, can the keyring access question dialog give users some information about why it is asking for what it is asking for?

I agree with the reporter it can surprise users and give bad impression.
Comment 2 Jesse Glick 2010-04-29 14:52:17 UTC 
(In reply to comment #1)
> can the keyring access question dialog give users some information about
> why it is asking for what it is asking for?

Perhaps. I don't know what the KWallet GUI even looks like. The NB integration has no GUI of its own, it simply asks KWallet for a password - any dialog would be part of KDE, not NetBeans.

You can run with -J-Dorg.netbeans.modules.keyring.level=FINE to see what key is being requested.

Anyway this is probably a duplicate of bug #181252, that NB was closing the wallet after each request.

(In reply to comment #0)
> it is not clear if the keyring data is requested by malicious or by trustworthy
> code

Any code running inside NetBeans must be considered to be trustworthy, since there are no internal security barriers.

*** This bug has been marked as a duplicate of bug 181252 ***