19

I've always read keyring like Gnome-keyring is safe way to save credentials. I don't understand it. If I open my Gnome-keyring in my Ubuntu Desktop, I can right click any entry and click show password and it will show the password :O. My point is if I can do it anyone who can access my computer can do it. I can't keep my computer attended every second and sometimes I can forget to lock the computer.

I've set option to unlock keyring automatically at login. Without that I've to type keyring password every time the keyring has to be accessed. So its either type the keyring password or type the asked password. Now if I really have to type I'd prefer to eliminate the middle man and type the asked password.

So my question is, am I thinking/taking/doing this keyring thing in wrong way? Or is it the way it is? If its the way it is, how is it safe?

4
  • 1
    It is preferred if you can post separate questions instead of combining your questions into one. That way, it helps the people answering your question and also others hunting for atleast one of your questions. Thanks!
    – Anwar
    Aug 2, 2012 at 11:14
  • I think you actually have a point. In my opinion to access "Passwords & Encryption Keys" one should be asked for the keyring password. An unlocked session is still a great security risk but it not justifiable to enable someone to get ALL your passwords and keys with just one click. Still agree with Jesse Glick's answer for the most part: askubuntu.com/a/112582/17789
    – con-f-use
    Aug 2, 2012 at 11:26
  • Hi I want to show saved password on my keyring in Ubuntu 14.04 , but I am not able to do Thanks for any helps Frank
    – user305082
    Jul 13, 2014 at 8:40
  • How do I "open" gnome-keyring? I only know how to run it as a command line utility. Mar 21, 2016 at 16:24

3 Answers 3

15

There is no special trick here; you are just responsible for keeping your desktop session locked when you are not sitting in front of your computer. Otherwise people walking by could do anything to your computer, even if you are not using a keyring of any kind, including installing a secret password-sniffing program!

Get in the habit of locking your screen whenever you get up for any reason. Do it even when you are sure you are alone so it becomes rote. This is quicker if you configure a keyboard shortcut like Ctrl+Alt+L for it (launch Keyboard --> Shortcuts --> System --> Lock screen). It would be nice if the Power control panel allowed you to lock the screen when a laptop lid is closed, but this does not seem to be an option.

And in case you forget, configure the screen to lock after a few minutes of inactivity (rather than going into a screensaver): Screen > Lock.

2
  • I'm really confused by this question/answer because it says in the GNOME wiki that gnome-keyring stores passwords using 128-bit AES encryption. Indeed, when I look at the files, they are encrypted. Is this answer out of date, or am I missing something here? Mar 21, 2016 at 16:33
  • 4
    seahorse will display the plaintext, since it has access to the unlocked session, so the fact that the passwords are encrypted on disk is of no help if your screen is left unlocked. Mar 23, 2016 at 14:53
7

Keyring is meant to simplify your life by remembering different secrets (passwords), which are stored encrypted using your master password as encryption key. The encryption is a protection against remote attack (or if your hdd gets stolen or similar), because secrets are not disclosed in such case. If you disable unlocking keyring at login, you get only the advantage of typing the same password, instead of many different ones.

3
  • I think his issue is that they can be read back in the clear at all, especially using the default UI by someone just walking by without having to install extra software. Shouldn't these passwords be protected so that they can only e.g. have a hash generated against them rather than be read back in the clear at all?
    – Rup
    Sep 14, 2011 at 10:29
  • @Rup: no, because these passwords have to be read back in clear whenever you use them.
    – johanvdw
    Sep 14, 2011 at 12:05
  • 1
    How do you view the passwords in plaintext? I'm trying to see this for myself but am only able to run gnome-keyring from the command line so far as I'm aware...? Mar 21, 2016 at 16:25
-5

The keyring uses weak encryption, yeah, weak. A simple password to unlock all your passwords? That's a joke in term of security. But it's easy to use, so a lot of people like it.

The common Joe or Alice (family, friends, co-workers) will not be able to decrypt it easily. If you want to protect your passwords against them, well. Keyring is safe.

Now, if someone with a degree in math, encryption, or a hacker is decided to get your passwords they will do it after a few days or weeks (or months if they are really unlucky).

And if the IRS gets you computer, well they can get a hand on the strong servers to get your passwords in a matter of minutes. Same for:

  • FBI
  • CIA
  • NSA
  • Mossad
  • ASIS
  • RAW
  • DGSE
  • FSB
  • BND
  • MSS
  • MI-6
  • ISI

So, is it safe? Well, it depends upon you and your needs.

6
  • 7
    What is your proof of this "uses weak encryption"? Do you know how much time a typical computer needs to break such encryption key or even break it at all.
    – Anwar
    Aug 2, 2012 at 11:22
  • 14
    gnome-keyring uses AES-128, which as of this date is computationally unfeasible to break other than by a brute force/dictionary attack.
    – ish
    Aug 2, 2012 at 11:46
  • @Vladimir Please provide proof that AES is unsafe against the FBI/CIA/etc and I'll give this a +1 and ask my friends to +1 it too. Also you'll likely win the nobel peace prize. Apr 16, 2020 at 0:18
  • I don't feel this post should have been so heavily down-voted. Seems to me that Vladimir is trying to raise a legitimate concern even if he may have had trouble communicating that concern. While unrelated to what Vladimir is saying, I recently ran across a post by @Bruno Pereira here that has me troubled... askubuntu.com/questions/65281/… I may be missing something but it seems to talk of a way to potentially retrieve keys in the ring without having to know the master password... Am I just confused?
    – Shawn Eary
    Jul 9, 2021 at 16:19
  • 1
    @ShawnEary The idea with cryptographic systems is not to keep them at the same strength over decades. As computational power increases, your OS default settings will have larger block sizes each release. If quantum computers become a problem, we'll likely have something like AES-8192 to compensate. Having said that, yes, cryptographic systems (especially key-pair setups) are extremely weak to quantum breakers. I believe the reason for all the downvotes here is airheaded fearmongering with nothing to back it up. Security is important, but fearmongering causes more problems that it solves. Jul 10, 2021 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy