Language Selection

English French German Italian Portuguese Spanish

GNOME Keyring

Filed under
Software
Security

For the past week or so, people have been talking about a “security issue” in Seahorse. This sums up my opinion on the matter:

This isn't a security issue, and there is no good way to fix it.

A password managing daemon, such as GNOME Keyring, increases the security of stored passwords for the following reasons:

  • Passwords are stored in a database that uses real encryption, not just an obfuscation scheme
  • A single code base needs to be audited to make sure no vulnerabilities exist in the encryption algorithms that are being used
  • The database is protected by a password that is known only to the user who unlocks it
  • Since the database is encrypted, no other user or bootable CD can recover the stored passwords if the unlock password is not known

So, if GNOME Keyring increases the security of user credentials, why can you see your passwords exposed in plain text when you open Seahorse? Because you've unlocked the keyring using your login password.

Full Post




More in Tux Machines

NGINX moves towards web server dominance with European expansion

Web server NGINX powers more than 317 million sites around the globes, and has rapidly replaced Apache as the engine of choice for the world's 100,000 busiest, counting Netflix, Airbnb and Dropbox among its high-profile clients. NGINX Inc - the company set up to commercialise the open source technology - has now set its sights on developing its business in Europe and recently opened a new EMEA headquarters in Cork, Ireland as a launching point to the region. NGINX began life as a web server written by a Russian engineer called Igor Syosev in 2002 while he was working as a system administrator for the portal site Rambler. Read more

Red Hat and Fedora