Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've always read keyring like Gnome-keyring is safe way to save credentials. I don't understand it. If I open my Gnome-keyring in my Ubuntu Desktop, I can right click any entry and click show password and it will show the password :O. My point is if I can do it anyone who can access my computer can do it. I can't keep my computer attended every second and sometimes I can forget to lock the computer.

I've set option to unlock keyring automatically at login. Without that I've to type keyring password every time the keyring has to be accessed. So its either type the keyring password or type the asked password. Now if I really have to type I'd prefer to eliminate the middle man and type the asked password.

So my question is, am I thinking/taking/doing this keyring thing in wrong way? Or is it the way it is? If its the way it is, how is it safe?

share|improve this question

migrated from stackoverflow.com Sep 14 '11 at 11:42

This question came from our site for professional and enthusiast programmers.

1  
It is preferred if you can post separate questions instead of combining your questions into one. That way, it helps the people answering your question and also others hunting for atleast one of your questions. Thanks! –  Anwar Shah Aug 2 '12 at 11:14
    
I think you actually have a point. In my opinion to access "Passwords & Encryption Keys" one should be asked for the keyring password. An unlocked session is still a great security risk but it not justifiable to enable someone to get ALL your passwords and keys with just one click. Still agree with Jesse Glick's answer for the most part: askubuntu.com/a/112582/17789 –  con-f-use Aug 2 '12 at 11:26
    
Hi I want to show saved password on my keyring in Ubuntu 14.04 , but I am not able to do Thanks for any helps Frank –  Franco Jul 13 at 8:40

3 Answers 3

Keyring is meant to simplify your life by remembering different secrets (passwords), which are stored encrypted using your master password as encryption key. The encryption is a protection against remote attack (or if your hdd gets stolen or similar), because secrets are not disclosed in such case. If you disable unlocking keyring at login, you get only the advantage of typing the same password, instead of many different ones.

share|improve this answer
    
I think his issue is that they can be read back in the clear at all, especially using the default UI by someone just walking by without having to install extra software. Shouldn't these passwords be protected so that they can only e.g. have a hash generated against them rather than be read back in the clear at all? –  Rup Sep 14 '11 at 10:29
    
@Rup: no, because these passwords have to be read back in clear whenever you use them. –  johanvdw Sep 14 '11 at 12:05

The keyring uses weak encryption, yeah, weak. A simple password to unlock all your passwords? That's a joke in term of security. But it's easy to use, so a lot of people like it.

The common Joe or Alice (family, friends, co-workers) will not be able to decrypt it easily. If you want to protect your passwords against them, well. Keyring is safe.

Now, if someone with a degree in math, encryption, or a hacker is decided to get your passwords they will do it after a few days or weeks (or months if they are really unlucky).

And if the IRS gets you computer, well they can get a hand on the strong servers to get your passwords in a matter of minutes. Same for:

  • FBI
  • CIA
  • NSA
  • Mossad
  • ASIS
  • RAW
  • DGSE
  • FSB
  • BND
  • MSS
  • MI-6
  • ISI

So, is it safe? Well, it depends upon you and your needs.

share|improve this answer
4  
What is your proof of this "uses weak encryption"? Do you know how much time a typical computer needs to break such encryption key or even break it at all. –  Anwar Shah Aug 2 '12 at 11:22
7  
gnome-keyring uses AES-128, which as of this date is computationally unfeasible to break other than by a brute force/dictionary attack. –  izx Aug 2 '12 at 11:46

There is no special trick here; you are just responsible for keeping your desktop session locked when you are not sitting in front of your computer. Otherwise people walking by could do anything to your computer, even if you are not using a keyring of any kind, including installing a secret password-sniffing program!

Get in the habit of locking your screen whenever you get up for any reason. Do it even when you are sure you are alone so it becomes rote. This is quicker if you configure a keyboard shortcut like Ctrl+Alt+L for it (launch Keyboard --> Shortcuts --> System --> Lock screen). It would be nice if the Power control panel allowed you to lock the screen when a laptop lid is closed, but this does not seem to be an option.

And in case you forget, configure the screen to lock after a few minutes of inactivity (rather than going into a screensaver): Screen > Lock.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.