Re: X-windows security in Gnome

[Havoc Pennington <hp redhat com>]

Benjamin Kahn <xkahn ximian com> writes: 
> 	Really?  How'd they solve this problem?  This happens to me a lot when
> running things like Evolution.  I have a mail server which requires
> authentication when sending mail.  I write an email, send it off, and
> then go do something else.  Often the password dialog comes up and I
> type for a little while before realizing what's happened.  It could
> probably be fixed if I only gave focus to new windows which were
> children of the current application, but what if I were composing a
> second email?  
> 

As far as I can tell their rule is:

 - never take focus from the current window when a new window opens
 - with a special exception for dialogs of the active app (I don't
   know if this is done in the "window manager" or if apps just
   explicitly set focus to dialogs)
 - when you launch an app from the start menu, that has the side 
   effect of focusing the taskbar, which means the new window can 
   get focus without having to take focus from the active app, 
   since the active app is no longer active.

If you consider secure keyboard just as a terminal option, the
Windows XP focus rules fix things entirely, since gnome-terminal never
pops up dialogs you didn't ask for.

If you want to talk about the broader problem for all apps, the XP
solution AFAIK doesn't cover the case where a dialog from the active
app pops up while using that app, but I think that case can be covered
case-by-case. For example, if you're typing an email, does it matter
security-wise if you accidentally type in the password dialog? I doubt
you were typing an invisible password into the email. ;-)

But if you did want to avoid this problem in a particular case, the
app could avoid marking the dialog as a child of the active window, or
just avoid popping up dialogs without explicit user action, or if a
dialog will take a short time to come up the app could be modal during
that time, or I'm sure there are many other answers.

Secure keyboard isn't a general solution for all apps anyway, unless
you want to have the menu item in every application, and choose it
every time you focus a window.

Havoc