[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [ide-dev] Having to log in to the IDE?

Stephan,

Yes, you can open a bug pretty much against any project that stores anything in the secure storage because the fundamental implementation problem is that it works well on Windows, and Mac, but sucks on Linux. So a simple solution (conceptually if not actually) is to fix the Linux implementation to use some type of native key ring support (no doubt there with 15 different variants of that, perhaps with at least two per GTK variant).

The problem at the design level are questions such as how can I know whether secure storage is accessible yet, how can I know whether it will be prompted if I do try access it, how can I know whether it contains a password for something that needs a password (i.e., some server access) without providing a master password to find out if there's something useful already in the store?

It's clear that on Linux, Firefox can store passwords and does not need you to enter a master password to use those stored passwords, so it's certainly a problem that's solvable... No doubt, given enough design effort, the use of stored passwords could be deferred as long as possible, and some additional storage could be used to remember whether the actual storage contains secure values that are useful to try to fetch. But in the end, it's hard (for me) to motivate large investments in Linux-only problems.

There are some pretty large organizations out there, that use Linux significantly, that could invest in solving such a problem, but perhaps they too have investment motivation problems...

Regards,
Ed


On 14.03.2017 20:03, Stephan Herrmann wrote:
Thanks Andrey, I've debugged some of these situations in the past.
The reason I'm raising the issue on this list is: I feel the
concept is broken by design. Filing bugs against all clients
of secure storage is a game nobody can win, in particular as long
as there is no agreement about good citizenship in this regard.

Am I missing anything?
Stephan


On 14.03.2017 19:55, Andrey Loskutov wrote:
Stephan,

This can be git client trying to read your repo informaton and may be configuring access to remote, but to be sure, please run jstack next time and fill a bug for the component you will find guilty :).

Am 14. MÃrz 2017 19:17:58 MEZ schrieb Stephan Herrmann <stephan.herrmann@xxxxxxxxx>:
Why do I have to log in, before I can use my (desktop) IDE?


Here's what I see:

- I live on Linux where Eclipse's secure storage is not backed by any
domain login,
but requires manually entering the password.

- I install Eclipse for simrel via Oomph.

- First thing Eclipse asks me before even doing anything is to enter my
password
for secure storage.


I don't like this for several reasons:

- I tend to use a good password for secure storage, so having to type
in the
password is a real disruption. I have to concentrate on s.t. that is
not my main
focus of work.

- That dialog doesn't give the faintest hint as to *why* my password is
required,
maybe fraud?

- Even considering the specific purpose of the setup for Simrel
contribution,
I cannot think of any reason why my password should be required.


I would be *a lot happier* with the Eclipse IDE if some or all of the following would change:

- No password dialog without specifying a reason

- No password dialog from background jobs, ever.

- No component requesting access to secure storage in an Oomph setup
where this isn't needed.


Is it just me? How do others feel about this? Stephan _______________________________________________ ide-dev mailing list ide-dev@xxxxxxxxxxx To change your delivery options, retrieve your password, or unsubscribe from this list, visit https://dev.eclipse.org/mailman/listinfo/ide-dev

-- Kind regards, Andrey Loskutov

http://google.com/+AndreyLoskutov


_______________________________________________
ide-dev mailing list
ide-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ide-dev