21

I've always read keyring like Gnome-keyring is safe way to save credentials. I don't understand it. If I open my Gnome-keyring in my Ubuntu Desktop, I can right click any entry and click show password and it will show the password :O. My point is if I can do it anyone who can access my computer can do it. I can't keep my computer attended every second and sometimes I can forget to lock the computer.

I've set option to unlock keyring automatically at login. Without that I've to type keyring password every time the keyring has to be accessed. So its either type the keyring password or type the asked password. Now if I really have to type I'd prefer to eliminate the middle man and type the asked password.

So my question is, am I thinking/taking/doing this keyring thing in wrong way? Or is it the way it is? If its the way it is, how is it safe?

Improve this question
4
  • 1
    It is preferred if you can post separate questions instead of combining your questions into one. That way, it helps the people answering your question and also others hunting for atleast one of your questions. Thanks!
    – Anwar
    Aug 2, 2012 at 11:14
  • I think you actually have a point. In my opinion to access "Passwords & Encryption Keys" one should be asked for the keyring password. An unlocked session is still a great security risk but it not justifiable to enable someone to get ALL your passwords and keys with just one click. Still agree with Jesse Glick's answer for the most part: askubuntu.com/a/112582/17789
    – con-f-use
    Aug 2, 2012 at 11:26
  • Hi I want to show saved password on my keyring in Ubuntu 14.04 , but I am not able to do Thanks for any helps Frank
    – user305082
    Jul 13, 2014 at 8:40
  • How do I "open" gnome-keyring? I only know how to run it as a command line utility.
    – temporary_user_name
    Mar 21, 2016 at 16:24

4 Answers 4

Reset to default
15

There is no special trick here; you are just responsible for keeping your desktop session locked when you are not sitting in front of your computer. Otherwise people walking by could do anything to your computer, even if you are not using a keyring of any kind, including installing a secret password-sniffing program!

Get in the habit of locking your screen whenever you get up for any reason. Do it even when you are sure you are alone so it becomes rote. This is quicker if you configure a keyboard shortcut like Ctrl+Alt+L for it (launch Keyboard --> Shortcuts --> System --> Lock screen). It would be nice if the Power control panel allowed you to lock the screen when a laptop lid is closed, but this does not seem to be an option.

And in case you forget, configure the screen to lock after a few minutes of inactivity (rather than going into a screensaver): Screen > Lock.

Improve this answer
2
  • I'm really confused by this question/answer because it says in the GNOME wiki that gnome-keyring stores passwords using 128-bit AES encryption. Indeed, when I look at the files, they are encrypted. Is this answer out of date, or am I missing something here?
    – temporary_user_name
    Mar 21, 2016 at 16:33
  • 4
    seahorse will display the plaintext, since it has access to the unlocked session, so the fact that the passwords are encrypted on disk is of no help if your screen is left unlocked.
    – Jesse Glick
    Mar 23, 2016 at 14:53
8

Keyring is meant to simplify your life by remembering different secrets (passwords), which are stored encrypted using your master password as encryption key. The encryption is a protection against remote attack (or if your hdd gets stolen or similar), because secrets are not disclosed in such case. If you disable unlocking keyring at login, you get only the advantage of typing the same password, instead of many different ones.

Improve this answer
5
  • I think his issue is that they can be read back in the clear at all, especially using the default UI by someone just walking by without having to install extra software. Shouldn't these passwords be protected so that they can only e.g. have a hash generated against them rather than be read back in the clear at all?
    – Rup
    Sep 14, 2011 at 10:29
  • @Rup: no, because these passwords have to be read back in clear whenever you use them.
    – johanvdw
    Sep 14, 2011 at 12:05
  • 1
    How do you view the passwords in plaintext? I'm trying to see this for myself but am only able to run gnome-keyring from the command line so far as I'm aware...?
    – temporary_user_name
    Mar 21, 2016 at 16:25
  • 1
    how does it matter that the passwords are stored encrypted? A remote attacker can just run secret-tool to decrypt and fetch the password, right?
    – Born2Smile
    Jun 29, 2022 at 8:27
  • @Born2Smile I had the same question than you then made some search and answered this
    – deFreitas
    Jan 28, 2023 at 21:46
1

There are some key features which makes gnome-keyring a credential software with a certain level of security:

  1. Centralizes and encrypt all stored credentials with a master password to help prevent unauthorized users from gaining access
  2. The master password must be input in a pop-up screen which also will gain the computer user attention and make him realize some strange behavior that can be caused by a malware or something like, also make it more difficult to some automated software do stuff silently.

The caveat here is that based on gnome-keyring philosophy, the master password will be asked once and cached forever, I did a lot of search and didn't found how to change this behavior natively, found an alternative though, to clear the cache every minute.

It will install a cron which run every minute and clear the cache:

$ cat <<EOF >> gnome-keyring-lock.sh
#!/bin/sh
export DBUS_SESSION_BUS_ADDRESS='${DBUS_SESSION_BUS_ADDRESS}'
dbus-send --dest=org.gnome.keyring --print-reply /org/freedesktop/secrets org.freedesktop.Secret.Service.LockService
EOF

$ chmod +x gnome-keyring-lock.sh &&\
  sudo mv gnome-keyring-lock.sh /usr/local/bin/

$ crontab -u ${USER} -e 
* * * * * /usr/local/bin/gnome-keyring-lock.sh 2>1 | logger -t gnome-keyring-lock

$<ESC>:wq

You can check the logs by typing:

$ tail  -f /var/log/syslog | grep gnome-keyring-lock
Jan 28 18:17:01 typer-pc gnome-keyring-lock: method return time=1674940621.720454 sender=:1.50 -> destination=:1.163 serial=204 reply_serial=2

This way the master password will be asked next time something try to recover some credential to gnome-keyring, keep in mind security and comfort are not friends, ask the master password every single time a credential is needed, probably won't last, cache them forever also doesn't sound like a good idea, despite the fact a computer connected to the internet will never be 100% secure, yes, gnome-keyring will help to keep the passwords more secure than just save them to a plain text file anywhere on your hard drive.

References

Improve this answer
1
  • 1
    Yes, clearing the password after a duration as you suggest would be a must have :) The part about the popup is wrong though, secret-tool does not launch a popup. It can be run via script in the background. Also, while the key chain is unlocked, all the passwords are freely available, not just the one that was needed. The encryption only matters when the key chain is locked :(
    – Born2Smile
    Mar 31 at 23:39
-6

The keyring uses weak encryption, yeah, weak. A simple password to unlock all your passwords? That's a joke in term of security. But it's easy to use, so a lot of people like it.

The common Joe or Alice (family, friends, co-workers) will not be able to decrypt it easily. If you want to protect your passwords against them, well. Keyring is safe.

Now, if someone with a degree in math, encryption, or a hacker is decided to get your passwords they will do it after a few days or weeks (or months if they are really unlucky).

And if the IRS gets you computer, well they can get a hand on the strong servers to get your passwords in a matter of minutes. Same for:

  • FBI
  • CIA
  • NSA
  • Mossad
  • ASIS
  • RAW
  • DGSE
  • FSB
  • BND
  • MSS
  • MI-6
  • ISI

So, is it safe? Well, it depends upon you and your needs.

Improve this answer
6
  • 7
    What is your proof of this "uses weak encryption"? Do you know how much time a typical computer needs to break such encryption key or even break it at all.
    – Anwar
    Aug 2, 2012 at 11:22
  • 14
    gnome-keyring uses AES-128, which as of this date is computationally unfeasible to break other than by a brute force/dictionary attack.
    – ish
    Aug 2, 2012 at 11:46
  • @Vladimir Please provide proof that AES is unsafe against the FBI/CIA/etc and I'll give this a +1 and ask my friends to +1 it too. Also you'll likely win the nobel peace prize.
    – aggregate1166877
    Apr 16, 2020 at 0:18
  • I don't feel this post should have been so heavily down-voted. Seems to me that Vladimir is trying to raise a legitimate concern even if he may have had trouble communicating that concern. While unrelated to what Vladimir is saying, I recently ran across a post by @Bruno Pereira here that has me troubled... askubuntu.com/questions/65281/… I may be missing something but it seems to talk of a way to potentially retrieve keys in the ring without having to know the master password... Am I just confused?
    – Shawn Eary
    Jul 9, 2021 at 16:19
  • 2
    @ShawnEary The idea with cryptographic systems is not to keep them at the same strength over decades. As computational power increases, your OS default settings will have larger block sizes each release. If quantum computers become a problem, we'll likely have something like AES-8192 to compensate. Having said that, yes, cryptographic systems (especially key-pair setups) are extremely weak to quantum breakers. I believe the reason for all the downvotes here is airheaded fearmongering with nothing to back it up. Security is important, but fearmongering causes more problems that it solves.
    – aggregate1166877
    Jul 10, 2021 at 0:12

You must log in to answer this question.