dbus-monitor shows exchange mail password in clear text [released]

asked 2014-04-04 17:05:05 +0200

Xiph
906 ●15 ●21 ●23

updated 2014-08-13 10:25:01 +0200

jiit
2678 ●32 ●58 ●59

  admin

I was fiddling with the dbus-monitor and noticed the password for my exchange mail flicker by on the screen. It seems like this could be a huge security hole since any app monitoring the dbus could get access to my exchange mail. Here is a draft of what I saw.

method call sender=:1.95 -> dest=org.freedesktop.DBus serial=31 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=GetConnectionUnixProcessID
       string ":1.20"
    signal sender=:1.95 -> dest=(null destination) serial=32 path=/com/google/code/AccountsSSO/SingleSignOn/AuthSession_2; interface=com.google.code.AccountsSSO.SingleSignOn.AuthSession; member=stateChanged
       int32 8
       string "The request is started successfully"
    method return sender=:1.95 -> dest=:1.20 reply_serial=233
       array [
          dict entry(
             string "Secret"
             variant             string "mypassword"
          )
          dict entry(
             string "UserName"
             variant             string "myemail@something.com"
          )
       ]