Re: Proposal: enable accessibility by default for GNOME

["Matthias Clasen" <matthias clasen gmail com>]

On Mon, Aug 4, 2008 at 11:14 AM, Simos Xenitellis
<simos lists googlemail com> wrote:
> On Thu, Jul 31, 2008 at 4:52 PM, Fernando Herrera <fherrera onirica com> wrote:
>> Hi,
>>
>> On Thu, Jul 31, 2008 at 5:32 PM, Willie Walker <William Walker sun com> wrote:
>>
>>> PRIMARY ARGUMENTS FOR ENABLING A11Y BY DEFAULT:
>> [...]
>>> 2) The a11y infrastructure can be used for more things than just a11y.
>>> Consider, for example, an on screen keyboard for devices w/o physical
>>> keyboards.
>>
>> I'd add scripting features here.
>>
>> With python dogtail bindings is quick and easy to write powerful
>> scripts for your desktop. This is not an end-user feature at all, but
>> is not an advanced-hacker-only one. So not having a11y enabled by
>> default limits scripts creating/deployment to those users that enable
>> a11y themselves and write their own scripts.
>>
>> Having a11y enabled by default would allow people to write and
>> distribute those scripts for normal users.
>
> An issue would be that with this facility it is possible for user apps
> to capture keys, including passwords.
>
> a. Enable Assistive Technologies
> b. Install python-dogtail
> c. Run dogtail-recorder, and keep it running
> d. Start System/Administration/Synaptic
> In Ubuntu it will ask you for your password. In other distros, select
> an appropriate program that asks a password.
> e. dogtail-recorder manages to capture the password entered.
>
> Is it possible to disable the capturing of keys when a textbox is set
> to show ●●●●●●● (instead of the actual characters)?
>
> Is there a way to disable the capturing of keys in a textbox in a
> non-reversible way once you requested it to show ●●●●●●●?
> In Windows, you can change back and forth by sending events, which
> allows to capture passwords.

Under X, you don't need the a11y framework to snoop on other
applications key events.
Google for xsnoop. And for xace for efforts on fixing this.