184470 - If Keychain is unlocked don't prompt for access.

Status: RESOLVED WORKSFORME

(Camino Graveyard :: OS Integration, defect)

Description

[Joseph Elwell]

If I tell Chimera to store my password to bugzilla in the keychain, why ask me
if bugzilla can have access to my keychain later? I've already implicitly given
my ok to bugzilla to access my keychain by storing my bugzilla password in the
keychain in the first place. If I didn't want bugzilla accessing my keychain, I
wouldn't have told Chimera to store my password there.

The only reason I can see a need for a prompt is for the user's keychain
password when the keychain is locked. Oddly enough in the case when the keychain
is locked, I type in my password and Chimera doesn't ask me if bugzilla should
have access to my keychain!

So Chimera is sending mixed messages to the user. If the keychain is unlocked
Chimera is saying "this remote site may be insecure but is asking for keychain
access". If the keychain is locked Chimera is saying "please unlock your
keychain." There's no mention about security of the remote site, so it is
implied that the security of the remote site is ok when the keychain is unlocked.

The state of the keychain, whether locked or unlocked shouldn't play a role in
how secure remote sites are. Chimera should honor the user's initial decision of
trusting the remote site when they added the site's password to their keychain,
and not second guess that decision by asking again.

Comment 1

[Simon Fraser [no longer active]]

->pink

Comment 2

[Mike Pinkerton (not reading bugmail)]

the keychain being unlocked isn't the final say on the subject. each key has a
list of apps which it always allows access to, or asks every time. i'm not
certain how to set it as "always allow" when adding to the keychain, but the
default seems to be "ask every time". The api has no way to set that when adding
a key.

*shrug*

Comment 3

[Brian Hagan]

The only time I get asked is when I upgrade my Chimera (Nightly build.) I
believe this IS correct behavior since in essence the app that is requesting the
access is different.

Are you seeing this when you use the same binary and have explicitly granted
Chimera to always have access?

Comment 4

[Simon Fraser [no longer active]]

Is this a WONTFIX or a WORKSFORME?

Comment 5

[Ed Mullins]

Regarding Comment #3: I always click "Always Allow" and I get the prompt every
session with the same binary... it only lasts until I quit the browser. All
other apps never prompt me again after I click Always Allow (until I get a new
binary).

Comment 6

[Blixman]

cannot replicate this...

Comment 7

[L. H.]

Since the keychain decides when to ask for access, not Camino, isn't this
invalid or wontfix?  It is the system or keychain's fault if it isn't
remembering Camino's authorization for some people.

Comment 8

[Samuel Sidler (old account; do not CC)]

Can't reproduce this at all. I'm pretty sure this bug is either no longer valid
or, as said in comment 7, invalid.

Marking as WORKSFORME.