Bug#729683: gnome-orca: orca reads password text entries aloud
Already fixed in Clutter:
https://git.gnome.org/browse/clutter/commit/?id=ccea1644ba81593fd19a772048e91909962ef570
--joanie
On 11/15/2013 02:04 PM, Daniel Kahn Gillmor wrote:
> Package: gnome-orca
> Version: 3.4.2-2
> Severity: normal
>
> Hi Orca folks--
>
> It looks like the gnome screen-reader reads back every key pressed
> into a password text entry field. If the computer in question has
> public audio enabled, this effectively reads the user's password aloud
> to anyone else in the room.
>
> Most egregiously, this happens in the gdm3 login greeter during
> password entry. This is particularly bad because anyone (without
> authentication) can enable the screen reader for the gdm3 greeter via
> the accessibility menu (see http://bugs.debian.org/689559), and leave
> it that way for the next person who logs in.
>
> I note that sometimes (i haven't been able to track down what the
> difference is), gnome does read each character of the password text as
> "asterisk". that's clumsy, but it's way better from a security point
> of view than the behavior i'm currently seeing (hearing).
>
> To reproduce the problem, i launched a kvm guest with a minimal wheezy
> install, then installed (without Recommends):
>
> xserver-xorg orca gnome-orca pulseaudio pulseaudio-module-x11 xbrlapi
> gnome-mag libbonobo2-bin speech-dispatcher-festival festvox-kallpc16k
> sox sound-icons openbox at-spi2-core desktop-base
> gnome-icon-theme-symbolic
>
> and then, finally:
>
> apt-get install gdm3
>
> It seems likely that an even more minimalist config could reproduce
> the problem too.
>
> --dkg
>
> -- System Information:
> Debian Release: 7.2
> APT prefers stable-updates
> APT policy: (500, 'stable-updates'), (500, 'stable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)
> Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages gnome-orca depends on:
> ii gir1.2-gtk-3.0 3.4.2-6
> ii gir1.2-pango-1.0 1.30.0-1
> ii gir1.2-wnck-3.0 3.4.2-1
> ii python 2.7.3-4+deb7u1
> ii python-brlapi 4.4-10+deb7u1
> ii python-cairo 1.8.8-1+b2
> ii python-dbus 1.1.1-1
> ii python-gi 3.2.2-2
> ii python-louis 2.4.1-1
> ii python-pyatspi2 2.5.3+dfsg-3
> ii python-speechd 0.7.1-6.2
> ii python-support 1.0.15
> ii python-xdg 0.19-5
> ii speech-dispatcher 0.7.1-6.2
>
> Versions of packages gnome-orca recommends:
> ii gnome-mag 1:0.16.3-1
> ii wget 1.13.4-3
> ii xbrlapi 4.4-10+deb7u1
>
> gnome-orca suggests no packages.
>
> -- no debconf information
>
>
Reply to: