Gnome - Passwords and Keys access without a password!

I was just going through the packages installed on Gnome via Arc menu, when I noticed 'Passwords and Keys'. I took a look and I was somewhat shocked to realise that certain passwords were provided without the need of a password to access them. Not only that, the redacted passwords can be displayed as plain text.

Surely this is a pretty big security hole. I could see evolution mail account passwords and my VPN password.
image

The default "Login" keyring is usually unlocked after you logged in with via GDM or any other login mechanism. This is done with the pam_gnome_keyring.so module of pam.

If you want to type in your password again after login to unlock the "Login" keyring, remove the lines with pam_gnome_keyring.so form the files in /etc/pam.d/...

Btw. this is a user specific keyring. A different user can't access this keyring, unless this user knows your password.

4 Likes

Hello Xabbu,

Thanks for your reassuring reply. I didn't realise it was user specific.

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.

Forum kindly sponsored by