-2

Can Seahorse really show all my passwords in clear text without re-asking for the root password? Isn't that a security issue?

Does it mean that all remote users can also see them?

If someone saves a password on a website I can see it in clear text (me or someone else using my computer), even if it is someone else who accessed the website.

I think being able to see a password must require a supervisor password in any case - I mean, no auto save password to see all autosaved passwords.

In the case someone uses the same password for mutiple access, you could be able to access forbidden things...

Being able to see password is a higher level of security than autosave, no?

closed as unclear what you're asking by dobey, Yaron, TheWanderer, Eric Carvalho, Wild Man Sep 27 '17 at 20:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    What are you asking exactly? Seahorse is just a GUI for the underlying keyring. It stores the passwords for the current user. Any user shouldn't need to authenticate as root to be able to see any of their own passwords. If you want to share access to the PC, you should create multiple users or have alternate users use the "Guest" account, instead of your own. – dobey Sep 26 '17 at 2:37
  • 1
    @dobey I think that really is the answer (starting with the second sentence). Are you willing to post it as one? – Eliah Kagan Sep 26 '17 at 3:29
1

This is not a security issue. Someone would need your password to be able to remotely access your PC etc for example using SSH. Users do not need to authenticate in order to see their own passwords, and it wouldn't make sense for a user to need to enter the root password in order to see their own passwords if they don't have root permissions.

  • sorry I was not clear .... seahorse has auto save unlock (all passwords) and if someone did access my pc, he would be able to check every password, without asking SU password. btw every users dont want to let admin know their webpassword where another level of security could be possible. – Jo Melnik DJ Sir-J Sep 30 '17 at 5:13
  • If you are afraid of people accessing your PC remotely, use a firewall, lock down ports, use Fail2Ban, disable SSH or require public key authentication and run SSH on a non-standard port if you must. If you are afraid of people accessing your PC locally, use full disk encryption and set your PC to automatically lock after like 20 minutes. – Ken Sep 30 '17 at 17:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.