[Libreoffice-bugs] [Bug 142147] Password protection on Writer malfunctioning

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=142147

--- Comment #14 from StromenNorman at mail.com ---
(In reply to Heiko Tietze from comment #12)
> (In reply to StromenNorman from comment #10)
> > 1) Why does the Writer programme (7.0.6.2 x64) no longer DEMAND that you
> > type in your password IF you edit the document? That is a MASSIVE security
> > flaw. Why give anybody the ability to edit YOUR document?
> This part has not been discussed yet. Leaving it to QA to test whether
> opening and editing had separate PW checks in the past. Or if this has
> changed; the PW options include an extra PW to allow editing.
>  
> > 2) What does the Writer programme now no longer have the box for Save With
> > Password ticked on a document which is ALREADY password protected?
> The point of SaveAs is to create a new document. And by default documents
> are not protected. So we have a good argument for the current state. It
> would be helpful to describe a use case. For example, "I use a protected
> template and expect the documents created based on it to be protected as
> well.". Sounds reasonable to me and easy to resolve.
> 
> (In reply to Dieter from comment #4)
> > Xisco, Vasiliy, you've worked on bug 133771. What do you think?
> Waiting for this input.

1) The programme behaviour that I'm complaining about is new. I.e. in the 
past, prior to recent updates of the programme, if I edited the password
protected document and hit Save As, which is my default choice of how to save a
document, the programme demanded that I input the password, twice. That is no
longer the case.

2) Why should how I choose to save a document (Save versus Save As) be an
excuse for the programme no longer demanding that I input my password, twice?

3) The security implications are blindingly obvious:

If my password protected document is open when I'm not around, anybody with
access to my PC can alter or delete the contents of that document without
needing to provide a password that they are the rightful owner of that
document. Well, since I've never tried deleting my password protected document,
from memory, I would certainly hope that if I tried deleting an open or an
unopened password protected document that the password dialogue box would
activate in that case.

Tomaz Vajngerl, re your comment that: "Do we want to save the documents with
the same password as the template. That's quite tricky...". Maybe you're
getting too technical for me. My scenario is of a person using a password
protected document and wanting to make sure that it can't be altered by anybody
else. You would think that any version of that same password protected document
should maintain password protection. The devs shouldn't judge people on how
they save documents, limiting what privileges it gives them. If I want to Save
As, let me at it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20210912/953b81a5/attachment.htm>