oss-sec mailing list archives
KDE Paste Applet
From: Michael Samuel <mik () miknet net>
Date: Tue, 28 May 2013 21:16:46 +1000
The paste applet included with kdeplasma-addons allows you to define macros that will copy some generated data into the clipboard, using simple macros to define the source and format of the data. The available macros include %{password(...)} which generates "random" passwords. Here is the code that generates the passwords (from pastemacroexpander.cpp): QDateTime now = QDateTime::currentDateTime(); qsrand(now.toTime_t() / now.time().msec()); for (int i = 0; i < charCount; ++i) { result += chars[qrand() % chars.count()]; } Breaking passwords generated by this (for example from leaked password hashes) can be done extremely quickly, especially if a password expiry or other hint is stored with the password. Workaround: You can change the macro you were using to a %{exec(...)} macro which calls a secure password generator. Please select your replacement carefully. I reported this to security () kde org and created a launchpad ticket against the Ubuntu package on May 13, followed up with a proof of concept on the 17th, and have received no response at all from either. Apologies if that was the wrong contact method. Regards, Michael
Current thread:
- KDE Paste Applet Michael Samuel (May 28)
- Re: KDE Paste Applet Kurt Seifried (May 29)
- Re: KDE Paste Applet Michael Samuel (May 30)
- Re: KDE Paste Applet Jeff Mitchell (May 31)
- Re: KDE Paste Applet Michael Samuel (Jun 12)
- Re: KDE Paste Applet Michael Samuel (Jun 25)
- Re: KDE Paste Applet Kurt Seifried (Jun 25)
- Re: KDE Paste Applet Garth Mollett (Jun 26)
- Re: KDE Paste Applet Michael Samuel (May 30)
- Re: KDE Paste Applet Kurt Seifried (May 29)