[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kmail-devel
Subject:    [Bug 95615] KWallet Request when quitting Kmail
From:       Thayer Williams <thayerw () gmail ! com>
Date:       2007-05-28 6:04:23
Message-ID: 20070528060423.26159.qmail () ktown ! kde ! org
[Download RAW message or body]

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
         
http://bugs.kde.org/show_bug.cgi?id=95615         




------- Additional Comments From thayerw gmail com  2007-05-28 08:04 -------
Because this is still present in KDE 3.5.7, I would like to make a couple suggestions. As far \
as I can tell, there are currently five possible ways to use KMail:

1) No KWallet, no KMail password storage
This scenario forces the user to enter a password for each account every time they open KMail.  \
Not exactly user-friendly, especially if they have 3-5 email accounts (as I do).

2) KMail password storage, KWallet disabled
In this scenario, the user stores the passwords locally within KMail itself.  However, the user \
must disable the entire KWallet system in order for this to work without constant nag screens. \
Again, not very user-friendly, since KWallet has a lot more to offer than simply storing email \
account passwords.

3) KMail passwords stored in KWallet with a master password
The KMail account passwords are stored within KWallet, forcing the user to enter the master \
Kwallet password each time they open KMail, assuming the wallet was not already opened.  Again, \
not very user-friendly. 

4) KMail passwords stored in KWallet with no master password
Sadly, this seems to be the advice of many forum posts.  In this scenario, not only are the \
KMail passwords completely vulnerable, but so are all the other passwords stored in the wallet.

5) Avoid using KMail entirely until this 2 year old bug is finally addressed
I am afraid that many who encounter the above annoyances will likely choose this option.  \
Having been a Thunderbird user for almost 3 years, I decided to migrate to KMail (Kontact \
actually) because of the excellent calendar integration.  However, I am finding this constant \
prompting of passwords too much.

I propose any one of the following solutions:

1) Make it possible for KMail to store passwords locally with and without KWallet system \
integration enabled.

2) Make it possible for KMail to reference a separate wallet that may be set with a blank \
password.  Although the KMail passwords would be insecure, the rest of the KWallet system \
integration would remain in tact.

3) Make an option for Kwallet to integrate into the user's logon password.  This way, the \
default wallet is authenticated automatically when a user logs into the KDE environment.  Say \
for example, if someone created a wallet with the same password as their logon credentials, KDE \
could pass that information onto KWallet.  This solution is perfect for folks who use KWallet \
for lesser items, such as wireless network passwords and email passwords.  It provides a \
transparent encryption as long as the user is logged in.  Then, for items requiring further \
security, the user can create a separate wallet with a stronger password or better yet, use a \
standalone program like PwManager.

This of course is all just speculation.  I'm no programmer so I have no idea how feasible it \
would be to implement any of these, but that's the way I see it.

KMail is a great email client and I want to stick with it, but if I can't find a sensible \
workaround for such a simple feature, I'll have to leave it behind. \
_______________________________________________ KMail developers mailing list
KMail-devel@kde.org
https://mail.kde.org/mailman/listinfo/kmail-devel


[prev in list] [next in list] [prev in thread] [next in thread]