Language Selection

English French German Italian Portuguese Spanish

GNOME Keyring

Filed under
Software
Security

For the past week or so, people have been talking about a “security issue” in Seahorse. This sums up my opinion on the matter:

This isn't a security issue, and there is no good way to fix it.

A password managing daemon, such as GNOME Keyring, increases the security of stored passwords for the following reasons:

  • Passwords are stored in a database that uses real encryption, not just an obfuscation scheme
  • A single code base needs to be audited to make sure no vulnerabilities exist in the encryption algorithms that are being used
  • The database is protected by a password that is known only to the user who unlocks it
  • Since the database is encrypted, no other user or bootable CD can recover the stored passwords if the unlock password is not known

So, if GNOME Keyring increases the security of user credentials, why can you see your passwords exposed in plain text when you open Seahorse? Because you've unlocked the keyring using your login password.

Full Post




More in Tux Machines

Ubuntu Touch to Land with Bq Aquaris e4.5 Phones in February

The first two companies that have been confirmed to release phones with Ubuntu Touch are Meizu and Bq. Until now, only Meizu showed any kind of involvement with Ubuntu Touch and they were the first to announce a launch window. On the other hand, Bq has been silent, but it seems to have been very busy and to be the first one out the door. Read more

Linux 3.19 Merge Window Closes Ahead Of Schedule

Linus announced on Friday night that he's closing the merge window early for 3.19. Torvalds said that he's pulling the last of the pull requests on Saturday -- related to KBuild and the READ_ONCE split-up -- but is planning to then close the merge window. Read more

X.Org Server 1.16.3 Released To Fix Security Issues

Julien Cristau of Debian announced the X.Org Server 1.16.3 release on Saturday morning. The primary focus of this release is on correcting the security issues within the GLX, DIX, XV, DRI3, RENDER, and other areas of the xorg-server code-base affected by outstanding security problems. Read more