<html> <head> <base href="https://bugs.documentfoundation.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Password protection on Writer malfunctioning" href="https://bugs.documentfoundation.org/show_bug.cgi?id=142147#c14">Comment # 14</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Password protection on Writer malfunctioning" href="https://bugs.documentfoundation.org/show_bug.cgi?id=142147">bug 142147</a> from <a class="email" href="mailto:StromenNorman@mail.com" title="StromenNorman@mail.com">StromenNorman@mail.com</a> <pre>(In reply to Heiko Tietze from <a href="show_bug.cgi?id=142147#c12">comment #12</a>) > (In reply to StromenNorman from <a href="show_bug.cgi?id=142147#c10">comment #10</a>) > > 1) Why does the Writer programme (7.0.6.2 x64) no longer DEMAND that you > > type in your password IF you edit the document? That is a MASSIVE security > > flaw. Why give anybody the ability to edit YOUR document? > This part has not been discussed yet. Leaving it to QA to test whether > opening and editing had separate PW checks in the past. Or if this has > changed; the PW options include an extra PW to allow editing. > > > 2) What does the Writer programme now no longer have the box for Save With > > Password ticked on a document which is ALREADY password protected? > The point of SaveAs is to create a new document. And by default documents > are not protected. So we have a good argument for the current state. It > would be helpful to describe a use case. For example, "I use a protected > template and expect the documents created based on it to be protected as > well.". Sounds reasonable to me and easy to resolve. > > (In reply to Dieter from <a href="show_bug.cgi?id=142147#c4">comment #4</a>) > > Xisco, Vasiliy, you've worked on <a class="bz_bug_link bz_status_VERIFIED bz_closed" title="VERIFIED FIXED - When saving an encrypted document, unchecking 'Save with password' has no effect, encryption is kept" href="show_bug.cgi?id=133771">bug 133771</a>. What do you think? > Waiting for this input. 1) The programme behaviour that I'm complaining about is new. I.e. in the past, prior to recent updates of the programme, if I edited the password protected document and hit Save As, which is my default choice of how to save a document, the programme demanded that I input the password, twice. That is no longer the case. 2) Why should how I choose to save a document (Save versus Save As) be an excuse for the programme no longer demanding that I input my password, twice? 3) The security implications are blindingly obvious: If my password protected document is open when I'm not around, anybody with access to my PC can alter or delete the contents of that document without needing to provide a password that they are the rightful owner of that document. Well, since I've never tried deleting my password protected document, from memory, I would certainly hope that if I tried deleting an open or an unopened password protected document that the password dialogue box would activate in that case. Tomaz Vajngerl, re your comment that: "Do we want to save the documents with the same password as the template. That's quite tricky...". Maybe you're getting too technical for me. My scenario is of a person using a password protected document and wanting to make sure that it can't be altered by anybody else. You would think that any version of that same password protected document should maintain password protection. The devs shouldn't judge people on how they save documents, limiting what privileges it gives them. If I want to Save As, let me at it.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>