search

Obsidian-StudiosInc / entrance

General purpose Display Manager built on the Enlightenment Foundation Libraries (EFL)
GNU General Public License v3.0
23 stars 10 forks source link

Password should be OPTIONAL #35

Closed madscientist42 closed 4 years ago

madscientist42 commented 4 years ago

Description

The presumption of the password being required (i.e. You have a password) is incorrect. For security purposes, yes, it's probably a good, good idea. The problem is that this isn't the job of the DM, this is the job of the security layers below instead of yourself. If the security is turned off for development reasons, etc. you should honor those changes instead of putting an impediment in the way. Just check to see if a blank password passes muster or not and then report that they don't have the password right.

How entrance is started

runit file. (Yes. And there will be more than one embedded distro doing this...) "exec entrance -n 2>&1" is the invocation.

System information

wltjr commented 4 years ago

Hi @madscientist42, thanks for the report. I assume the issue is with the field validation to ensure something was input when the button is pressed. If so, that should be easy enough to remove and/or make optional. it is likely a habit from making web based login forms where a password is always required. I did not take into consideration some may intentionally not have a password set. That makes sense, and I can easily remove that block of code. Not sure it makes any sense for it to be a configurable option. Thus, easier to remove than add more code to make it optional.

madscientist42 commented 4 years ago

This works. And I assumed that it was a general good habit in the wrong place there- and yeah, it makes more sense to do what I proposed, which is to just attempt the login and fail. :D

madscientist42 commented 4 years ago

We (MSI) will likely have things ultimately as a reconfigurable- and will have password security on at that point, but they want a developer mode that provides E to the display, etc. for this product I can't disclose details about. Then there's my own personal embedded/non-embedded distro building up as a result of all of this plus being the maintainer now of runit that will be using this stuff. :D

In the end, I'm tickled that this is being supported and am looking forward to it's future.

wltjr commented 4 years ago

Ok, so maybe I should go with an option to disable/enable rather than flat out removal. I have not worked on re-making the UI for configuration so now is a better time to be making configurable modifications.

I have been super short on time for the last year or so. Prior to such, I was making progress on dbus integration working towards Wayland support. Eventually, Entrance will support Wayland and X11. The project is definitely alive, I rely upon it daily, and will eventually get back to furthering the code base in various ways. I am happy you have found use and are looking forward to the future of Entrance. Hopefully, it will have some worth while features and be one of the main DM/LM available, not just for E users/developers.

I will work this issue ASAP, hopefully within a week or so. Thanks!

wltjr commented 4 years ago

@madscientist42 ok, there you go. Try that out and see if it works as needed. It seems to on my end. At least it disables the warning. Hopefully, you are able to fully log in to an account that does not have a password. Probably also need to test out autologin, but I assume that works as it does now if you change the setting in the conf file.

Let me know if you have issues, or things do not work. Thanks!