[ jEdit-devel ] [ jedit-Plugin Bugs-3615163 ] FTP Plugin demanding 'master password to decrypt' breaks

[SourceForge.net <no...@so...>]

Plugin Bugs item #3615163, was opened at 2013-10-30 14:32
Message generated for change (Comment added) made by ariel-co
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=565475&aid=3615163&group_id=588

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: FTP
Group: None
Status: Closed
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Mark Crocker (mcrocker)
Assigned to: Alan Ezust (ezust)
Summary: FTP Plugin demanding 'master password to decrypt' breaks

Initial Comment:
After upgrading to jEdit FTP plugin version 1.0.6 restarting jEdit with a session that already has many open remote files will demand a master password for each open file.  

For a user who was not expecting this, it is a very jarring experience and this blocks the main jEdit window from appearing until all files password challenges are answered in some way.  There is no explanation what is going on and on Windows 7 Professions SP1, the dialogs always appear underneath all other windows, so after most actions, the dialogs just seem to disappear and nothing seems to happen.  There is also no indication which file is being challenged, so when a dozen seemingly identical challenges appear in a row for a password the user doesn't know anything about, they will likely get frustrated and kill jEdit rather than continue.

If the user selects cancel for the master password challenges, then an FTP dialog with no password will appear for one of the remote files.  Entering the password, which jEdit used to remember for that file and selecting OK, results in another dialog asking the user to 'Choose a master password to enecrypt your new password file'.  Entering a value there and clicking OK restarts the master password challenge loop, except that the FTP dialog for the first file will now have a value for the password and proceeding leads to a dialog for the second open remote file with a blank password entry.  If a user actually goes through this process for each open remote file, then when completed, the actual jEdit main window will open, but NONE of the remote files will be included. For a large number of open remote files, this can take a considerable length of time and, if the wrong button is clicked at any time result in having to start over!

Also, if a user selects cancel for each master password challenge until the main window appears and then attempts to change to another session with no open remote files, the buffers will be empty for each file in the new session.

Finally, the updated plugin documentation mentioned that there was a way to enable/disable encryption in the plugin options FTP page, but I do not see that in the dialog.  There is an option for using a key file and for using compression, but not for encryption as the documentation seems to suggest there should be.

Although I really appreciate the effort to add password encryption, this change is really not ready for release and I strongly recommend that it be rolled back until a working solution is found.

----------------------------------------------------------------------

Comment By: arielCo (ariel-co)
Date: 2013-10-31 16:38

Message:
I can't find a way to attach a file, so here it goes:
http://pastebin.com/dGhdsK94

----------------------------------------------------------------------

Comment By: arielCo (ariel-co)
Date: 2013-10-31 16:34

Message:
Hi Alan,
I installed the JCE security JARs, downloaded the FTP.jar you provide and
what happens is:

* Fire up jEdit
* File > Open: the "Connect to Secure FTP Server" dialog comes up (since
the file browser was last browsing a remote site), pre-filled with the last
hostname and username.
* enter password > Enter: "Choose a master password to encrypt your new
password file" dialog comes up.
* enter new master password > Enter: dialog closes, File Browser doesn't
come up. I have the main window with the default empty buffer.

I'm attaching %APPDATA%\jEdit\activity.log.

----------------------------------------------------------------------

Comment By: Alan Ezust (ezust)
Date: 2013-10-31 08:54

Message:
Committed 23303 to FTP plugin in SVN. Now if you "cancel" when it asks you
for the master password, then the option for saving passwords is set to
false.
you can test this version: http://lazarus.oddiofile.com/jars/FTP.jar


----------------------------------------------------------------------

Comment By: Alan Ezust (ezust)
Date: 2013-10-31 08:05

Message:
What you are describing "asking over and over again" for a masterpassword,
happens if it is unable to
open the existing saved passwords file. Since older password files are
unreable, it doesn't matter what master password you supply, you can never
open it. The only workaround for this is to "forget remote passwords",
which will delete that old password file. After that everything should work
as expected.


----------------------------------------------------------------------

Comment By: Alan Ezust (ezust)
Date: 2013-10-30 15:32

Message:
Duplicate of 3615141

----------------------------------------------------------------------

Comment By: Alan Ezust (ezust)
Date: 2013-10-30 15:21

Message:
Are you seeing in teh status bar that JCE strong encryption is not
available? If so, then you can't save passwords. 
Un-check the option "save passwords and passphrases to disk" or read the
documentation about how to enable JCE strong encryption. There is no option
to disable encryption. 

If you are not getting a "JCE strong encryption unavailable" in your
statusbar, please describe the steps to reproduce your bug.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=565475&aid=3615163&group_id=588