Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

As with anything that wants my passwords I want to know about the how safe it is to use the gnome-online-accounts [g-o-a] feature (and how it can be exploited). I'm only interested in the Google part of it since that is all that is available at the moment.

I want to understand if it stores my password in any way - I get the impression it uses some kind of token authentication but I don't understand this. Is it possible to steal a password (or similar?) from my computer through g-o-a?

All the documentation that I have found is far too complex for a normal person to understand.

share|improve this question
    
NB: Gnome Online Accounts stores the credential keys (although not the Facebook nor Google passwords — just the tokens returned from the pop-up asking for your password from those services) in your Keyring. So, you can use the "Passwords and Keys" program to see exactly what it's storing. EG: a key like GOA google credentials for identity account_$(NUMBER) will have a “Password:” field with some JSON data in it. (You can choose to view it in the P&K program, aka "Seahorse") –  BRPocock Nov 29 '12 at 15:29

1 Answer 1

up vote 2 down vote accepted

Short answer: You can probably trust g-o-a if you use Twitter, Facebook and Google-accounts and you're faced with a login-page that looks native to those services (e.g. a facebook-styleish login box instead of a GNOME-styleish one). Edit: However, always assume your accounts are compromised. g-o-a might not be the weakest link, but the more links you've got on a chain, the more likely it is that one of it is going to be weak. Always treat your data carefully.

Long answer: Depending on what service you use it either uses a "token authentication" (see http://en.wikipedia.org/wiki/OAuth ) or clear text passwords. The worst case scenario for e.g. Twitter is that someone sends spam with your account, but they won't have access to sensitive data (however, if you store passwords in Chrome/Firefox - that's an entierly different matter) and the "hackers" cannot steal your password or change it. You can just go onto the security settings (on Twitter) and then delete the OAuth-token for your g-o-a.

This is different for different services. On Google (and Facebook), you can specify app-specific passwords if you're worried about your privacy. If these passwords are stolen, you can just delete them.

At the end of the day, exploiting g-o-a might not be that valuable unless you're actually targeting a specific person you know runs GNOME, since most people (I dare to say) stores their passwords in Firefox/IE/Chrome, which both should be less secure and more common - like telling a child not to steal candy from an open candy jar and then go away shopping for an hour.

If you're worried about g-o-a, you should always reset your browsing history (and cookies etc.) in your browser when closing the browser and not running any unofficial Facebook apps etc.

share|improve this answer
    
Thanks. Your short answer is the reason phishing is so successful; not a good mentality for important mail accounts. The fact that it uses OAuth for Google means atleast your account can't be stolen (but can be abused). This still means that a stolen computer = compromised accounts until you get around to revoking. –  t3hmun Feb 23 '12 at 17:46
    
Agreed, you should always treat your accounts carefully. My point was that g-o-a is probably not the weakest link ;) –  sakjur Feb 24 '12 at 14:00
    
Added a disclaimer ;) –  sakjur Feb 24 '12 at 14:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.