Bug 125724

Summary:	Wallet password dialog allows focus to be stolen while entering a password
Product:	[Applications] kwalletmanager	Reporter:	Gunter Ohrner <kdebugs>
Component:	general	Assignee:	Valentin Rusu <valir>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	andrewb, dannybaumann, kde2, renan.t.inacio, valir
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	Debian testing
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description Gunter Ohrner 2006-04-17 12:31:44 UTC

Version:            (using KDE KDE 3.5.2)
Installed from:    Debian testing/unstable Packages
OS:                Linux

If a kde wallet passwort dialog is open and a new window open in the meantime, it should never get the focus, independantly of KDE's current focus stealing prevetion setting.

It already happened a few times to me that a Kopete IRC window popped up while I was entering my password and I wrote the last part of my password into some IRC channel. Fortunately I always noticed that and was able to change my wallet password in these cases, but it's definitely annoying and I'd even consider that to be a security risk: It's unforseeable where the password might be sent to if any window can take the focus from the password dialog.

A security sensitive application like the KDE Wallet should take the "better safe than sorry" approach eg. used by pinentry-qt, which grabs the keyboard and doen't let go of it until the dialog is closed.

Comment 1 andrewb 2006-09-04 03:29:47 UTC

I'd like to second this, and point out a situation where the current behaviour always sucks:
0. Make sure your wallets are closed
1. Press Alt+F2 to bring up the run command dialog
2. Type in the URL of a website for which konqueror needs a password from the wallet, eg. some https URL with authentication information cached in the wallet. Press Enter.
3. Wallet dialog pops up requesting wallet password. Half a second later a useless "Loading Progress" dialog appears and steals the focus from the password entry dialog.
4. Use mouse/keyboard etc. to refocus password dialog and enter the password.

Very annoying! This happens for me in KDE 3.5.4 (Fedora packages).

Comment 2 Renan Inácio 2010-07-09 15:15:34 UTC

This is also a bug in KDE 4.4.2.
I tried setting the specific window preferences so the kwallet dialog has "extreme" focus stealing prevention. However, the effect is kwallet not stealing focus, instead of other applications not stealing focus from it.

Comment 3 Danny Baumann 2010-10-07 08:45:04 UTC

Why is this bug assigned to kwin? For the reasons outlined in the OP, this behaviour should be prevented in kwallet itself and not depend on any window manager and its settings.

Looking at gnome-keyring, it's correctly implemented there: It's not possible to steal focus from the password prompt, no matter what WM is used.

Comment 4 Thomas Lübking 2010-10-07 14:11:25 UTC

no idea about gnoome-keyring, but:
if kwallet intends to grab the pointer, ensure to also map onto the current desktop, and in addition add a timer to the show event (1-2 secs) and at the other end check for the current desktop again (otherwise move)
overmore monitor mouseclicks and if they occur outside the kwallet window, release the mouse.

"i've got the focus and won't give it away" is pretty "dangerous"

Comment 5 Martin Flöser 2011-12-10 10:41:33 UTC

I agree with comment #3 that this is nothing kwin can or should do (till Wayland). Sorry for assigning such a corpse to kwallet. Feel free to just close it due to new ksecretservice

Comment 6 Diggory Hardy 2013-01-28 15:20:31 UTC

Martin, KWin already has "focus stealing prevention". Can't a version of this working the other way around be added: allow a window to be marked such that other windows cannot steal focus?

Why I think this should be dealt with by the window manager:
1) the window manager can differentiate explicit switches by the user and new windows popping up (IMHO it's only the latter which shouldn't get focus)
2) It seems odd that a window is able to lock the keyboard: if a password window pops up, locks the keyboard but somehow doesn't get focus (has happened to me), then the apparent effect is that the keyboard doesn't work (took me a few seconds to work out why, and I can imagine other people taking longer)

Comment 7 Valentin Rusu 2013-09-03 21:48:07 UTC


*** This bug has been marked as a duplicate of bug 141267 ***