Comments on: Did You Know Gnome Lets Anyone See Your Keyring Passwords (MSN, WiFi, Twitter, etc) Without Needing A Password?

By: seo services

seo services — Tue, 05 Jan 2010 23:07:00 +0000

The problem with that is no one is teaching the basics. -Shobazee

By: Matrimony

Matrimony — Tue, 05 Jan 2010 12:03:00 +0000

thats something new i never knew that could happen.

By: freedating

freedating — Tue, 05 Jan 2010 11:59:00 +0000

thanks for the heads up.

By: John Smith

John Smith — Sun, 15 Nov 2009 07:09:00 +0000

I agree, if you have to use a password for so many much smaller things… why not this?

By: d0od

d0od — Mon, 02 Nov 2009 17:00:00 +0000

You might’ve been better off posting your rant in the thread i’m reporting on, not the report itself. Don’t shoot the messenger and all that…

By: njlinuxmike

njlinuxmike — Mon, 02 Nov 2009 16:05:00 +0000

This is an ignorant complaint. You are faulting the system for assuming you are the user who actually logged in. You provide a PW upon login! If you dont then YOU told the system to log you in automaticaly. That was your doing. Dont blame the system when you dont like the way you configured it.

By: Kamilion

Kamilion — Sat, 31 Oct 2009 22:54:00 +0000

This is not a security flaw.

When you installed ubuntu, you chose an account password.
Then, when you first login, the first time seahorse is accessed, it asks you to choose a keyring password.

IF you just press enter, seahorse will then automatically unlock your login keyring for you.
It displays a scary box that says:

Store passwords unencrypted?
By choosing to use a blank password, your stored passwords will not be safely encrypted.
They will be accessible to anyone with access to your files.
[ Cancel ] [ Use Unsafe Storage ]

You can easily change this by opening seahorse, right clicking the login keychain, and selecting Change Password.

Choose a password other than your account password.

By: Jacopo

Jacopo — Fri, 30 Oct 2009 15:27:00 +0000

However you can right-click on the login folder and then click on “Block”: if you want to see passwords, you have to unblock it and therefore give login password.

By: Johan

Johan — Fri, 30 Oct 2009 09:00:00 +0000

You identify yourself by logging in, which is why the keyring is unlocked at login. The computer is correctly assuming that the logged in user is using the computer until the user logs out/locks the session.
In earlier releases, when the keyring wasn’t unlocked at login, users using wireless networks had to enter their password twice – once for login, and once for unlocking the keyring to allow access to network passwords.
When other people are around, lock the computer when leaving it.

By: snkiz

snkiz — Thu, 29 Oct 2009 13:43:00 +0000

Agreed The problem with that is no one is teaching the basics. A lot of people don’t even know seahorse is there.

By: bhm

bhm — Thu, 29 Oct 2009 11:51:00 +0000

When you have physical access to PC, hands down, there’s no barriers.

That’s not a bug, that’s not an issue. This should be in a papercuts. Still exaggerated.

By: Miquel

Miquel — Thu, 29 Oct 2009 10:49:00 +0000

I think you’re exaggerating and inflaming the situation by saying anyone can see your keyring “without needing to enter so much as a password.” This is blatantly untrue, because you first have to login in order to gain access to the keyring. Even if you auto-login, you still have to enter your password to open the keyring.

This makes perfect sense to me — if you login, you unlock all your personal data on the computer. If people don’t understand this, then they have an IT education or comprehension problem which is bigger than revealing a few IM passwords.

If people want to share a computer, they should be taught to have separate users and to log out or lock their screen when they’re done. If they want to let someone have impromptu access, there is the ability to switch to a temporary guest account. I think teaching users basic security habits is a far better solution than changing a sensible usability pattern. I don’t want to have to enter my password yet again — I’m already sick of logging into things — software should be becoming more usable, not less.

By: Steffen

Steffen — Thu, 29 Oct 2009 09:22:00 +0000

In firefox you are asked for creating a general password.

By: Steffen

Steffen — Thu, 29 Oct 2009 09:20:00 +0000

Not really. Sure protecting your personal data is your responsibility, but the system has to support this. If you have windows you often can’t choose security options and the whole security architecture is unsafe by default.

By: Name

Name — Thu, 29 Oct 2009 09:08:00 +0000

â€œProtecting your personal data is your responsibility, not the system’sâ€

Except when it’s windows… then it’s allways microsoft’s fault, right?
sigh…

By: Steffen

Steffen — Thu, 29 Oct 2009 09:04:00 +0000

Hi,

The standard situation on login is that you have to enter your password at login. If you choose to login automatically without entering a password then it is your decision and the risk is obvious.

The key chain “login” is opened on login by default. If you have an auto login then it is open as well. But you can change the password of the key chain “login” as you want. Then you are prompted for a password. And once more you are free in your decision to store your passwords in seahorse, but for me it is a convenient and save way.

Maybe my English is not good enough but I do not understand the “bug”.

Steffen

By: Noel

Noel — Thu, 29 Oct 2009 07:45:00 +0000

Firefox has had this ‘feature’ for a long time now. Anyone with access to your pc can just look at your saved passwords within firefox.

By: Name

Name — Thu, 29 Oct 2009 05:39:00 +0000

Do these instructions include entering your password to log into your desktop in the first place?

By: Martini1179

Martini1179 — Thu, 29 Oct 2009 05:20:00 +0000

I don’t know if it’s apathy or a misguided sense of personal responsibility, but the opinions of Bachstelze regarding this issue are crap. I somewhat agree with him if “personal data” involves only documents, music, pictures and the like, but protecting the integrity of the system by restricting access to passwords should be in a separate category.

Sure, an argument can be made that no one can access your passwords if they cannot log into your account in the first place, but I’d argue that once you’re in, you’re in, and any wayward soul that wanted to get your passwords, could, provided he had the knowledge. From personal experience, people don’t routinely log out when leaving the computer unattended, even with others around. Password integrity should be absolute, with GNOME taking an active part in not sharing personal information instead of relying on the conscience of my techie friends.

By: Name

Name — Thu, 29 Oct 2009 05:07:00 +0000

Ubuntu forum thread: http://ubuntuforums.org/showthread.php?t=1302342