diff --git a/ChangeLog b/ChangeLog
index 9304075ba..ccff55763 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,6 @@
 20020125
- - (djm) Don't grab Xserver by default. x11-ssh-askpass doesn't and grabbing
-   can cause deadlocks with kinput2
+ - (djm) Don't grab Xserver or pointer by default. x11-ssh-askpass doesn't 
+   and grabbing can cause deadlocks with kinput2. 
 
 20020124
  - (stevesk) Makefile.in: bug #61; delete commented line for now.
@@ -7394,4 +7394,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1795 2002/01/24 13:46:04 djm Exp $
+$Id: ChangeLog,v 1.1796 2002/01/24 13:59:25 djm Exp $
diff --git a/contrib/gnome-ssh-askpass.c b/contrib/gnome-ssh-askpass.c
index 949b80781..7cece5620 100644
--- a/contrib/gnome-ssh-askpass.c
+++ b/contrib/gnome-ssh-askpass.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2001 Damien Miller.  All rights reserved.
+ * Copyright (c) 2000-2002 Damien Miller.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,11 @@
  * environment variable SSH_ASKPASS to point to the location of 
  * gnome-ssh-askpass before calling "ssh-add < /dev/null". 
  *
- * There is only one run-time option: if you set the environment variable
+ * There is only two run-time options: if you set the environment variable
  * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab
- * the X server. This may have some benefit to security if you don't trust
-  * your X server. We grab the keyboard and pointer anyway.
+ * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the 
+ * pointer will be grabbed too. These may have some benefit to security if 
+ * you don't trust your X server. We grab the keyboard always.
  */
 
 /*
@@ -68,10 +69,11 @@ passphrase_dialog(char *message)
 {
 	char *passphrase;
 	char **messages;
-	int result, i, grab_server;
+	int result, i, grab_server, grab_pointer;
 	GtkWidget *dialog, *entry, *label;
 
 	grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
+	grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL);
 
 	dialog = gnome_dialog_new("OpenSSH", GNOME_STOCK_BUTTON_OK,
 	    GNOME_STOCK_BUTTON_CANCEL, NULL);
@@ -103,8 +105,8 @@ passphrase_dialog(char *message)
 	/* Grab focus */
 	if (grab_server)
 		XGrabServer(GDK_DISPLAY());
-	if (gdk_pointer_grab(dialog->window, TRUE, 0, NULL, NULL, 
-	    GDK_CURRENT_TIME))
+	if (grab_pointer && gdk_pointer_grab(dialog->window, TRUE, 0, 
+	    NULL, NULL, GDK_CURRENT_TIME))
 		goto nograb;
 	if (gdk_keyboard_grab(dialog->window, FALSE, GDK_CURRENT_TIME))
 		goto nograbkb;
@@ -118,7 +120,8 @@ passphrase_dialog(char *message)
 	/* Ungrab */
 	if (grab_server)
 		XUngrabServer(GDK_DISPLAY());
-	gdk_pointer_ungrab(GDK_CURRENT_TIME);
+	if (grab_pointer)
+		gdk_pointer_ungrab(GDK_CURRENT_TIME);
 	gdk_keyboard_ungrab(GDK_CURRENT_TIME);
 	gdk_flush();