565670 - Information disclosure when using notifications and xscreensaver

Status: REOPENED

(Thunderbird :: OS Integration, defect)

Description

[Stanislav Ochotnicky]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100330 Fedora/3.5.9-2.fc12 Firefox/3.5.9
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100330 Fedora/3.0.4-1.fc12 Lightning/1.0b2pre Thunderbird/3.0.4

When using notifications for incoming emails thunderbird apparently places them on top of all windows, even above screensaver. This is fine during normal execution, but should be disabled when xscreensaver is visible, because information about last unread emails can be disclosed.

Reproducible: Always

Steps to Reproduce:
1. Turn on email notifications in preferences (on by default)
2. Start xscreensaver and wait until it turns on (or turn it on manually with xscreensaver-command -lock)
3. Send email to set-up account from another computer
4. Watch monitor
Actual Results:  
Notification about incoming email and last unread emails is shown on top of xscreensaver even though screen is locked.

Expected Results:  
No notification should be shown.

I can see 2 solutions:
1. Turn off notifications while screen saver is running
2. Make notifications appear on lower level (not on-top)

Comment 1

[Wayne Mery (:wsmwk)]

Dimitris, can you reproduce this?

Comment 2

[Wayne Mery (:wsmwk)]

Theo, is this something you can test?

Comment 3

[Théo Chevalier]

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #2)
> Theo, is this something you can test?

Unfortunately I can’t be of much help here, I’m using macOS these days, and notifications on lockscreen are a feature there

Comment 4

[Wayne Mery (:wsmwk)]

Walt, can you test?

Comment 5

[WaltS48 [:walts48]]

Yes, I can.

I installed xscreensaver and set it to start after 2 minutes.
Set my POP and IMAP accounts to check for mail every five minutes.
Sent an email from each account to the other using Thunderbird 52.0b3 on Ubuntu 16.04 LTS.
Let the screensaver activate.
The Notification appeared on top of the screensaver when the accounts received the mail.

Comment 6

[Wayne Mery (:wsmwk)]

Walt, thanks for testing

Comment 7

[Stanislav Ochotnicky]

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #6)
> Walt, thanks for testing

Hmm, did you accidentally close as WORKSFORME? I read the test as confirming my original bugreport - i.e. the notifications appear above the screensaver - I am asserting they should not do that.

Comment 8

[WaltS48 [:walts48]]

(In reply to Stanislav Ochotnicky from comment #7)
> (In reply to Wayne Mery (:wsmwk, NI for questions) from comment #6)
> > Walt, thanks for testing
> 
> Hmm, did you accidentally close as WORKSFORME? I read the test as confirming
> my original bugreport - i.e. the notifications appear above the screensaver
> - I am asserting they should not do that.

Sorry, I meant to ask the same question, but got busy with other things and forgot.

I did confirm your findings.

Comment 9

[Wayne Mery (:wsmwk)]

Anyone can reopen a bug  :)

Comment 10

[castilma]

I'll leave this [1] here as a potential starting point for someone to dig into this.

[1]: https://www.jwz.org/xscreensaver/faq.html#popup-windows