I've always read keyring like Gnome-keyring is safe way to save credentials. I don't understand it. If I open my Gnome-keyring in my Ubuntu Desktop, I can right click any entry and click show password and it will show the password :O. My point is if I can do it anyone who can access my computer can do it. I can't keep my computer attended every second and sometimes I can forget to lock the computer.

I've set option to unlock keyring automatically at login. Without that I've to type keyring password every time the keyring has to be accessed. So its either type the keyring password or type the asked password. Now if I really have to type I'd prefer to eliminate the middle man and type the asked password.

So my question is, am I thinking/taking/doing this keyring thing in wrong way? Or is it the way it is? If its the way it is, how is it safe?

  • 1
    It is preferred if you can post separate questions instead of combining your questions into one. That way, it helps the people answering your question and also others hunting for atleast one of your questions. Thanks! – Anwar Aug 2 '12 at 11:14
  • I think you actually have a point. In my opinion to access "Passwords & Encryption Keys" one should be asked for the keyring password. An unlocked session is still a great security risk but it not justifiable to enable someone to get ALL your passwords and keys with just one click. Still agree with Jesse Glick's answer for the most part: askubuntu.com/a/112582/17789 – con-f-use Aug 2 '12 at 11:26
  • Hi I want to show saved password on my keyring in Ubuntu 14.04 , but I am not able to do Thanks for any helps Frank – user305082 Jul 13 '14 at 8:40
  • How do I "open" gnome-keyring? I only know how to run it as a command line utility. – temporary_user_name Mar 21 '16 at 16:24

There is no special trick here; you are just responsible for keeping your desktop session locked when you are not sitting in front of your computer. Otherwise people walking by could do anything to your computer, even if you are not using a keyring of any kind, including installing a secret password-sniffing program!

Get in the habit of locking your screen whenever you get up for any reason. Do it even when you are sure you are alone so it becomes rote. This is quicker if you configure a keyboard shortcut like Ctrl+Alt+L for it (launch Keyboard --> Shortcuts --> System --> Lock screen). It would be nice if the Power control panel allowed you to lock the screen when a laptop lid is closed, but this does not seem to be an option.

And in case you forget, configure the screen to lock after a few minutes of inactivity (rather than going into a screensaver): Screen > Lock.

  • I'm really confused by this question/answer because it says in the GNOME wiki that gnome-keyring stores passwords using 128-bit AES encryption. Indeed, when I look at the files, they are encrypted. Is this answer out of date, or am I missing something here? – temporary_user_name Mar 21 '16 at 16:33
  • 3
    seahorse will display the plaintext, since it has access to the unlocked session, so the fact that the passwords are encrypted on disk is of no help if your screen is left unlocked. – Jesse Glick Mar 23 '16 at 14:53

Keyring is meant to simplify your life by remembering different secrets (passwords), which are stored encrypted using your master password as encryption key. The encryption is a protection against remote attack (or if your hdd gets stolen or similar), because secrets are not disclosed in such case. If you disable unlocking keyring at login, you get only the advantage of typing the same password, instead of many different ones.

  • I think his issue is that they can be read back in the clear at all, especially using the default UI by someone just walking by without having to install extra software. Shouldn't these passwords be protected so that they can only e.g. have a hash generated against them rather than be read back in the clear at all? – Rup Sep 14 '11 at 10:29
  • @Rup: no, because these passwords have to be read back in clear whenever you use them. – johanvdw Sep 14 '11 at 12:05
  • 1
    How do you view the passwords in plaintext? I'm trying to see this for myself but am only able to run gnome-keyring from the command line so far as I'm aware...? – temporary_user_name Mar 21 '16 at 16:25

The keyring uses weak encryption, yeah, weak. A simple password to unlock all your passwords? That's a joke in term of security. But it's easy to use, so a lot of people like it.

The common Joe or Alice (family, friends, co-workers) will not be able to decrypt it easily. If you want to protect your passwords against them, well. Keyring is safe.

Now, if someone with a degree in math, encryption, or a hacker is decided to get your passwords they will do it after a few days or weeks (or months if they are really unlucky).

And if the IRS gets you computer, well they can get a hand on the strong servers to get your passwords in a matter of minutes. Same for:

  • FBI
  • CIA
  • NSA
  • Mossad
  • ASIS
  • RAW
  • DGSE
  • FSB
  • BND
  • MSS
  • MI-6
  • ISI

So, is it safe? Well, it depends upon you and your needs.

  • 7
    What is your proof of this "uses weak encryption"? Do you know how much time a typical computer needs to break such encryption key or even break it at all. – Anwar Aug 2 '12 at 11:22
  • 14
    gnome-keyring uses AES-128, which as of this date is computationally unfeasible to break other than by a brute force/dictionary attack. – ish Aug 2 '12 at 11:46
  • @Vladimir Please provide proof that AES is unsafe against the FBI/CIA/etc and I'll give this a +1 and ask my friends to +1 it too. Also you'll likely win the nobel peace prize. – aggregate1166877 Apr 16 '20 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy