do not store ticked recipients from last encryption
Reported by steve | February 24th, 2014 @ 12:16 PM | in 1.10b1 (closed)
This is both a usability and potential low security problem.
Reproduce:
- encrypt a file to 5 recipients
- encrypt another file
- those previous 5 recipients are still ticked off
Issues with this:
- my main complaint about this is, that with large keyrings 500+x entries and the very narrow GPGServices window, even if you scroll through the recipients list, chances are you will not spot that 5 entries which are still ticked off
- how does the user know if any recipient at all is still ticked?
- worst case: send out a symmetric encrypted file (which the user thinks is only going to be encrypted with a phassphrase) and still have recipients from last encryption included
- that would reveal with whom you are communicating, and the party this is revealed maybe should not have that info
Thus I suggest, to start GPGServices with all recipients unticket whenever the GPGServices window is launched.
Comments and changes to this ticket
-
steve April 30th, 2014 @ 03:35 PM
- State changed from “new” to “verified”
- Assigned user set to “Mento”
- Milestone set to “1.10b1”
We now have a checkbox to select / deselect all. If any recipient is checked, users will see the standard "-" checkbox indicating that some but not all items are active. Click that "-" to deselect any previous recipients.
I like this implementation, since if you have a group of let's say 10 people you often encrypt to, removing previous recipients as a default could be a big annoyance.
Thus I think this is a nice solution. Fixed and since it worked in my tests, verified.
Thanks Mento!
-
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Luke Le
steve