New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Copy after timeout #189

Closed
vorph1 opened this Issue Jul 9, 2016 · 4 comments

Comments

Projects
None yet
2 participants
@vorph1

vorph1 commented Jul 9, 2016

Hi, currently (as of 1.1.3) it is possible to copy password using the "copy password" button after the timeout has passed without the need to unlock gpg again.

Steps:

  1. unlock password
  2. wait for the field with password to change to "_Password and Content hidden_"
  3. click "Copy Password"

Password is copied to clipboard

Expected:
Gpg popup requesting key unlock

@annejan

This comment has been minimized.

Member

annejan commented Jul 11, 2016

Yes, I agree . . mostly

Currently the password is kept in-memory even after clearing the display or clipboard.
This should probably not be the case.

Wether or not GPG pops up is mostly dependent on the GPG Agent settings though, not QtPass' settings.

My proposal, check on password/content hide if password is still needed (for clipboard clear check).
Empty "last decrypt" password.
Clipboard clear should always dispose of "last decrypt" after use . .

@vorph1

This comment has been minimized.

vorph1 commented Jul 11, 2016

Perhaps i didn't make this clear enough, this has nothing to do with gpg agent. When i click any other password in the tree after the timeout gpg-agent unlock is invoked correctly. The issue is only with last used password and the copy to clipboard feature. I should also note that both my gpg agent and qtpass have the same timeout for clear/lock set.

@annejan

This comment has been minimized.

Member

annejan commented Jul 11, 2016

I'm sorry my monday-morning comment was not all that clear.

Currently the password is kept in-memory even after clearing the display or clipboard.
This should probably not be the case.

And yes . . this is purely a QtPass issue .. nothing to do with gpg-agent.

My proposal, check on password/content hide if password is still needed (for clipboard clear check).
Empty "last decrypt" password.
Clipboard clear should always dispose of "last decrypt" after use . .

@annejan

This comment has been minimized.

Member

annejan commented Nov 19, 2016

Fixed in #218 #222 #223

@annejan annejan closed this Nov 19, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment