#785305 keepass2: option to lock workspace on suspend does not work

Package:
keepass2
Source:
keepass2
Submitter:
Todor Tsankov
Date:
2015-11-04 01:57:41 UTC
Severity:
wishlist
#785305#5
Date:
2015-05-14 14:04:25 UTC
From:
To:
Dear Maintainer,

The two options "Lock workspace when locking the computer"
and "Lock workspace when the computer is about to be suspended"
do not function. This makes possible reading user's secrets
from memory if, for example, a laptop is stolen while suspended
and the software is running. The two options are specifically
designed to prevent this from happening and a user who has
enabled them will expect to be protected from such an attack.

I am using Gnome on Debian Jessie.
#785305#10
Date:
2015-05-25 09:13:02 UTC
From:
To:
Hi!

Is there any progress on this bug? I really loose Keepass2 a lot and I
saw that is marked for removal because of this bug.

Can I help you somehow? Has it been forwared to upstream yet?

Greetings
Peter
#785305#15
Date:
2015-05-25 10:02:08 UTC
From:
To:
Odd, isn't this the role of GNOME, rather than Keepass2? I'm on Ubuntu and my
screen is locked when going into sleep mode under normal circumstances. This
is without using Keepass2.
#785305#20
Date:
2015-05-25 10:10:22 UTC
From:
To:
I think there is a misunderstanding of the word "workspace". An opened
keepass file is also called "workspace".
#785305#25
Date:
2015-05-25 20:16:02 UTC
From:
To:
forwarded 785305 https://sourceforge.net/p/keepass/bugs/1378/
kthxbye

Hmm. I just poked at the keepass2 source code, and it looks like it depends on
Windows-based system events (SessionEnding, SessionSwitch, and PowerModeChanged)
which aren't implemented in Mono:
https://github.com/mono/mono/blob/master/mcs/class/System/Microsoft.Win32/SystemEvents.cs#L127

...and while looking for the upstream bug tracer, I just found an upstream bug:
https://sourceforge.net/p/keepass/bugs/1378/
#785305#32
Date:
2015-06-17 05:28:20 UTC
From:
To:
From version 2.30 onwards, keepass would disable those
options while running on mono [1]. We could fix this asap if
someone could figure out how to make a diff of the snapshot.

[1]: http://sourceforge.net/p/keepass/bugs/1378/#8e7b
#785305#37
Date:
2015-08-05 06:42:24 UTC
From:
To:
On Wed, Jun 17, 2015 at 01:28:20AM -0400, Braiam Peguero wrote:

Hi,

So if I understand this correctly 2.30 will just not offer those options
anymore. I'd argue for downgrading the severity of this bug to allow
keepass2 back in stretch. The functionality is basically wontfix in
upstream, it will just be hidden.

Regarding a patch, I could not find a public keepass2 repository, and
the development snapshot linked in above bug is a binary.

Bernhard
#785305#42
Date:
2015-08-06 15:14:24 UTC
From:
To:
Control: severity -1 wishlist
Control: tags -1 + wontfix upstream - security

Agreed, this feature is simply not available on Mono. Since this feature is not
implemented and upstream will remove the nonavailable option, this is basically a wishlist.

And even if users would try to use it they will clearly see that their workspace was not locked after resume.