Re: GtkEntry memory vtable (to use non-pageable memory for passwords)

[Matthias Clasen <matthias clasen gmail com>]

On Sun, Mar 1, 2009 at 7:47 AM, Sven Neumann <sven gimp org> wrote:
> Hi,
>
> On Sun, 2009-03-01 at 01:01 +0000, Stef wrote:
>
>> This leads me to wonder if perhaps the password entry control in GTK+
>> might fare better as a separate widget. There's an insane amount of "if
>> (entry->visible)" in the code and alternate code paths for password entry.
>
> I definitely think so. GtkEntry is getting more and more complex
> recently and it seems like a bad idea to use such complex code for
> sensitive stuff like a password entry. IMO it would make sense to create
> a dedicated widget for this. Perhaps it is possible to share a common
> base class, but we should try to keep all the complex stuff that is not
> needed in a password entry out of it.
>
> So perhaps as a start, try to make a list of the features that are
> needed, or might be useful, in a password entry?

Some of the recently added new features are specifically for password
entries, like the caps lock
warning. A password entry looks just like a regular entry, and people
expect to be able to use the features they know from other entries. I
really don't think using a 'dumbed down' GtkEntry for passwords is the
way forward (which is what started this discussion in the first
place...). Finally, it seems a bit silly to use a memory locked entry
for your keyring password, when all the other passwords you enter
(login screen, lock dialog, your online banking website) don't.