Fix for master password expose for pidgin

[ubuntugeek]

Pidgin stores you passwords in plain text in ~/.purple/accounts.xml.Someone can easily boot into recovery mode while you are away and find your passwords in plain text.

You can download the patch from Here

[deryni]

This patch is unlikely to be accepted as is for a number of reasons, not least of which is the fact that it adds a hard dependency on NSS to pidgin. But also the fact that the correct way to do this is to integrate pidgin with existing system password storage systems (a task for which there is a SoC project this year). I'm assigning this to the SoC mentor for that project in case it has any use there.

Oh, one last thing, there really isn't any point to tarring up a single file, it just adds extraction annoyance for people downloading it.

[rlaager]

I'm copying the patch here so that we have a copy of it. I think we may end up doing a backend based on this.

[datallah]

Ticket #7215 has been marked as a duplicate of this ticket.

[mlissner]

Is there any hope of a fix for this? The summer is nearly over?

[rlaager]

The code from SoC is pretty close to ready. The problem is that it makes backwards-incompatible changes to the API. Those can be avoided, but only with dirty hackery that isn't guaranteed to work. At this point, we're working towards a 3.0.0 release where we can bundle up a number of these backwards-incompatible changes.

[mlissner]

Ah, I see. Thanks for the update then. That makes sense, especially considering certain things such as the empathy vs pidgin debate.