Passwords should not be required when creating accounts

Have you installed telepathy-core package? I think empathy should depend on telepathy-core since it is useless otherwise.

I have not, because it pulls in dependencies on crap I don't want, like telepathy-idle (irc), telepathy-sofiasip, telepathy-butterfly (MSN). telepathy-gabble should do the job just fine for what I need, as far as I know. It did fine for gossip-telepathy.

You have to fill the password too. Incomplete accounts are not saved by MC. That's not an empathy bug, it's a MC feature :)

I think you use the term "feature" rather liberally. ;-)

It's odd, given that you can clear out the password after the account has been created...but then it doesn't prompt you for one and won't connect.

It definitely *shouldnt* require you to store the password though, given that it's presumably unencrypted, or encrypted reversibly.

installing empathy-core plus all dependency fixed this issue for me.

empathy-core package is not available anymore. But there is telepathy-core.
Can you still add account with final release ? I was able to before, but I can't anymore (see Bug #156444).

http://bugzilla.gnome.org/show_bug.cgi?id=512539

I'm still encountering this bug. And it is a bug, not a feature. "Incomplete" accounts are in fact saved by mc. Evidence: any additional accounts get the name "jabber1","jabber2", "jabber3", etc. These accounts show up in gconf under /apps/telepathy/mc/accounts/jabber1, 2, 3, etc. So it is a bug in empathy, not a feature of mission control.

Could you try with the last version uploaded in hardy? (0.21.90-2)

This is in 0.21.90-2

This is not related to the bug Guillaume Desmottes mentioned (this one is related to genders of messages in empathy).

This is still a problem in empathy 2.24.0.

This is still a problem in 2.27.92, in Karmic Alpha 6. Why is this program, with such a glaring security issue, going to be the new default?

Everett: the newest version is 2.28.0-0ubuntu2.... Please try that before any further comments.

Thanks for the quick response, Brian. Just upgraded to 2.28.0 and found nothing changed. It is still impossible to add an account without saving a password, and impossible to remove that password once saved.

Since your attempting to either create a brand new account, or use an existing account. You should already know the password and/or be able to insert one to use in your new account creating. What do you expect to be able to do?

I expect to be able to add a new account to Empathy WITHOUT HAVING MY PASSWORD SAVED. Unfortunately, this is not possible, even in the newest version of Empathy in Karmic.

This was mentioned earlier in this bug, in comment #3 and comment #4. However, I can clearly see that this is not the focus of the bug. Also, my bug, focused on the password saving problem, bug #391659, was marked as a duplicate of this bug.

Is it so hard to understand why an app forcing users to save their passwords -- and having that app be included by default with Ubuntu -- is a very, very bad idea?

I completely agree with Everett Guerny.

An Ubuntu release with a default chat client that won't let you create an account without saving a password is seriously broken.

And if that's not the subject of this bug, then what is the subject of this bug? And #391659 needs to cease to be marked as a duplicate of this bug.

The subject of this bug is "Cannot add account", nor in the description of the bug report does it say that accounts should be able to be created without saving a password. I believe it would be of interest to get the bug title changed, and edit the description as well.. which I will go ahead and do.

I do feel that the intention of the bug reporter was to make sure accounts could be created without passwords inserted.

Thank you for clerifying your idea.

Architecture: amd64
DistroRelease: Ubuntu 9.10
NonfreeKernelModules: fglrx
Package: empathy 2.28.0-0ubuntu2
PackageArchitecture: amd64
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_US.UTF-8
ProcVersionSignature: Ubuntu 2.6.31-11.36-generic
Uname: Linux 2.6.31-11-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

I certainly have systems I'd rather not store passwords on, I think for a default client, this is not Low and should be addressed.

lol, thanks scott.. i was getting there. Agreed, it should be high and addressed.

Thanks for understanding. :-)

Maybe I'm trying to convince people who are already convinced, but creating an account without giving the password, and more importantly without store it is a problem in the following user case.

Cécile has to connect herself sometime on the computer of her sister Camille. Since Cécile don't trust her sister and just wants to have an account set up, but wants to have to enter her password each time.

The strong dependency of Empathy on the keyring make that possibility impossible, so that Cécile has to use GoogleTalk online or even Kopete ;)

Laurent: Since the bug priority was just reduced, the bug hasn't been fixed, and is two years old, and Ubuntu is about to be released with a default chat client (this) that forces users to store their passwords, there are clearly still relevant people who need to be convinced.

Martin: Why was the priority reduced?

Triagers use https://wiki.ubuntu.com/Bugs/Importance for setting importance on bugs.
Of course these are always debatable to certain extents.

I don't think this is important enough to be a release blocker, and pidgin is still available in main (and won't be cleaned up on upgrades).

We have nobody to work on this right now, and since pidgin is still in main (and will even be kept on upgrades), this isn't a blocker for karmic release. It's just a msising feature, thus isn't appropriate for an SRU as well.

Wouldn't the sensible thing to do be keep the non-security-compromising app (pidgin) as the default until its replacement is ready to not compromise the security of those who use it?

Maybe pidgin should be the default IM program again, since Empathy is not
ready yet for security reasons. Empathy still will be in main repos if
somebody want it...

2009/10/22 Everett Guerny <email address hidden>

> Wouldn't the sensible thing to do be keep the non-security-compromising
> app (pidgin) as the default until its replacement is ready to not
> compromise the security of those who use it?
>
> --
> Passwords should not be required when creating accounts
> https://bugs.launchpad.net/bugs/118800
> You received this bug notification because you are a direct subscriber
> of a duplicate bug.
>
> Status in High-level library and user-interface for Telepathy: Unknown
> Status in “empathy” package in Ubuntu: Triaged
> Status in empathy in Ubuntu Karmic: Won't Fix
> Status in “empathy” package in Baltix: New
>
> Bug description:
> Binary package hint: empathy
>
> I cannot add an account to empathy. If I open the accounts window, hit
> add, select type: jabber, fill in a name ("home"), fill in my account info,
> and then hit close, then when I open the accounts window again the account
> is not listed.
>
> This also applies to other account types.
>
> EDIT (09-28-2009): the nature of this report should be that accounts should
> be able to be created without requiring passwords.
>

I agree with Everett and Ricardo. I recently posted a bug (https://bugs.launchpad.net/ubuntu/+source/telepathy-butterfly/+bug/457942) which also rises an important security issue related to the usage of Empathy. Setting Empathy as default IM client for Karmic seems to me to be a bad idea. If it is still the case, these security problems should clearly be exposed so users can switch to pidgin if they want.

I agree that empathy should not be the default chat client until this issue is resolved, and that it should be switched to pidgin, as it has been in previous releases.

Forget the bug I mentionned in comment #32, it is invalid...

The upstream bug is still marked as UNCONFIRMED. I confirmed it in bugzilla since it's probably better if upstream is more aware of it.

It looks like Empathy uses the Gnome keyring for storing passwords, so at least they are encrypted when saved (unlike Pidgin). I agree that it would be good to not require password saving. But at least the passwords should not be readable by anyone else even with admin or physical access to the computer they are saved on, unless that person has your login password to the machine (or whatever other password you're using for Gnome keyring).

In a "shared family computer" where the PC automatically logins a random user, this "feature" in empathy is useless, and actually puts your passwords at risks. It is quite curious that empathy does not allow configuring accounts in such a way that it asks for the password everytime it connects, if the user so wishes.
I'm hoping at some point the app will mature and add this functionality

This is the real bug: https://bugs.freedesktop.org/show_bug.cgi?id=24868

and of course any sort of Kerberos account won't have a password either.

I think this is very important to fix. I love Empathy but I just can't have my password stored anywhere in plain text (I'm assuming plain text here, would love to be corrected).

Thanks

(If you post a question to a bug please subscribe yourself to the bug so you can see the reply. Amr I've subscribed you this bug so you can see the reply :) )

Amr:
The answer is somewhat complicated and boils down to "it is probably encrypted on disk".

Empathy passwords are stored in the GNOME keyring, which by default is encrypted on disk using your login password. It is possible to override this and use unsafe storage with your GNOME keyring in which case it will be stored on disk in something that amounts to plain text.

Once a keyring is unlocked all passwords can be viewed in their original unencrypted form. Typically, when you log in your keyring unlocked.

Thank you Sitsofe, appreciate it. What you described seem to be much better than my pessimistic expectation :)

Yet, IMHO this still doesn't lift off the ultimate need for this feature for shared & corporate environments

Gnome 586562 was marked as a duplicate

this issue have been fixed in Natty Narwal with empathy 2.33.x