Language Selection

English French German Italian Portuguese Spanish

GNOME Keyring

Filed under
Software
Security

For the past week or so, people have been talking about a “security issue” in Seahorse. This sums up my opinion on the matter:

This isn't a security issue, and there is no good way to fix it.

A password managing daemon, such as GNOME Keyring, increases the security of stored passwords for the following reasons:

  • Passwords are stored in a database that uses real encryption, not just an obfuscation scheme
  • A single code base needs to be audited to make sure no vulnerabilities exist in the encryption algorithms that are being used
  • The database is protected by a password that is known only to the user who unlocks it
  • Since the database is encrypted, no other user or bootable CD can recover the stored passwords if the unlock password is not known

So, if GNOME Keyring increases the security of user credentials, why can you see your passwords exposed in plain text when you open Seahorse? Because you've unlocked the keyring using your login password.

Full Post




More in Tux Machines

A Few Laps With Fedora 22

In a sentence, it’s another winner in a long line of winners from Fedora. If you’re a Fedora user, you’ll love Fedora 22. If you’re not a Fedora user and want to try it, it’s worth the effort to get it to where you want it. The caveat here is that you may have to tweak it a bit to do what more mainstream distros like Linux Mint or Ubuntu do out of the box. If you’re up to it, then go for it. Read more

Meizu MX4 Ubuntu Comming to Europe Soon, New BQ Ubuntu Phone Also Planned

Canonical is preparing for the launch of the Meizu MX4 Ubuntu Edition in Europe and it looks like Bq is also preparing to release a new phone on the European market as well. Read more

5 Reasons To Buy Android Over Apple's iOS and Microsoft's Windows

With Android, it’s a numbers game. Plain and simple. You want choice in devices, Android gives you that. Sure, it’s a bit of a minefield and you might come across some brands that you’ve never heard off, or incredibly convincing fakes that run a fully working version of Android (no counterfeiter has managed to successfully load a dodgy version of iOS on to a device yet). Read more

Fedora 22: The Latest