search

CSSE1001 / MyPyTutor

Interactive tutorial application for Python3.
Other
7 stars 12 forks source link

Verify that students cannot pull each other's passwords out of keyring #131

Closed sapi closed 9 years ago

sapi commented 9 years ago

(This is prefaced on the idea of keyring actually installing on the lab computers. Not sure if we actually have permission to do that, which might be for the best.)

On a lab machine, multiple students can log in to the same computer. There will only be a single install of keyring. Theoretically, the system keychain should store things on a per-user basis. I believe that this is what OS X does, but I'm not sure about Windows.

We need to verify, if keyring is to be used on such machines, that students cannot (from the console) pull out stored passwords for another user. Basically, we just need to log in with two different users, store a password with one, and try to pull it with another.

pjritee commented 9 years ago

Given we need to have a working system ASAP maybe we should temporarily drop the keyring idea for now. Could we just look to see if there is already a keyring on the system and if so use it and if not always ask for user name/passwd?

sapi commented 9 years ago

That's what it does at the moment. You'll only be promoted for a username and password if you've installed keyring. If you choose not to, you shouldn't be asked again. (The install prompt will show a maximum of once, in other words.)

On Saturday, February 28, 2015, Peter Robinson notifications@github.com wrote:

Given we need to have a working system ASAP maybe we should temporarily drop the keyring idea for now. Could we just look to see if there is already a keyring on the system and if so use it and if not always ask for user name/passwd?

— Reply to this email directly or view it on GitHub https://github.com/CSSE1001/MyPyTutor/issues/131#issuecomment-76499550.

sapi commented 9 years ago

Perhaps a blank username should set that flag as well.

On Saturday, February 28, 2015, Sean Purdon sean.purdon@gmail.com wrote:

That's what it does at the moment. You'll only be promoted for a username and password if you've installed keyring. If you choose not to, you shouldn't be asked again. (The install prompt will show a maximum of once, in other words.)

On Saturday, February 28, 2015, Peter Robinson <notifications@github.com javascript:_e(%7B%7D,'cvml','notifications@github.com');> wrote:

Given we need to have a working system ASAP maybe we should temporarily drop the keyring idea for now. Could we just look to see if there is already a keyring on the system and if so use it and if not always ask for user name/passwd?

— Reply to this email directly or view it on GitHub https://github.com/CSSE1001/MyPyTutor/issues/131#issuecomment-76499550.

sapi commented 9 years ago

This does not appear to be possible on the lab machines.

However, it also appears that keyring does not persist between logins, which 'somewhat' limits its utility.