Asking for an exception to be made for our snap (WhoShares)

store-requests
1

Wish to have both of these interfaces automatically connected ( password-manager-service, network-observe )

  1. password-manager-service: I use secured storage to store some critical information about our users that subscribe to premium plan (note: the app is principally an offline app).

  2. network-observe: Since our app is used to share files locally across any desktop platforms, I make use of the ping command to work with / identify some NetworkInterfaces address.

Thanks and hoping for an approval.

2

+1 from me for auto-connect network-observe to identify NetworkInterfaces addresses as explained. Can other @reviewers please vote?

Regarding password-manager-service, have you explored the possibility of storing your users critical information in an area private to the snap? By plugging password-manager-service whoshares is able to access all stored secrets but also your snap’s secrets can be accessed by any other applications with access to the service.

3

+1 from me too for auto-connect network-observe for whoshares.

Also as @emitorino asked, as password-manager-service is shared between all snaps which plug this interface and all traditional / classic desktop applications which use the keyring, they can each see each other’s secrets that are stored there - so in general it is better to not use this interface and instead just store credentials locally in say $SNAP_USER_DATA which is then private to the snap in question.

4

+1 from me for auto-connect network-observe for whoshares, as well.

5

+3 votes for, 0 votes against, granting auto-connect of network-observe to whoshares, this is now live.

@jeffrey whenever you can, please comment about the password-manager-service alternative we suggested.

Thanks!

6

Thanks for the suggestions, but unfortunately it’s not possible for me to define such path since i use a Flutter Plugin to handle this and it doesn’t provide any option for such configuration.

7

Regarding password-manager-service - given the sensitivity of the data stored in the keyring we generally erred on the side of not auto-connecting this in the past since we feel that it is important for users to be able to make an informed decision around granting this access. As such, -1 from me for auto-connect of this - instead I recommend that applications using this interface detect its availability (eg, with snap is-connected password-manager-service ) and show a dialog with instructions on how to connect the interface manually (eg, with snap connect , the snap store GUI, etc). Ideally when instructing the user, the details of the access will be explained so the user can make an informed choice. While this is an extra step for the user, if done well the process should provide additional trust that your snap and the system as a whole are working together to keep the user’s passwords secure. Alternatively, the snap may choose to store the secrets outside the keyring in an area private to the snap. -1 to auto-connect of this interface.

8

Okay thanks @alexmurray, I will look into this solutions closely and implement one.

1 Like
9

I also vote -1 to auto-connect password-manager-service. 0 votes for, -2 votes against, not granting auto-connection of password-manager-service to whoshares.

@jeffrey if you have any question regarding storing secrets or showing dialogs providing instructions to explain manual connections, please let us know. We are now removing this request from our review queue in the meantime.