Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Several Linux tools for this purpose have existed for a while as well - gnome-keyring (now seahorse)[1], KWallet, etc.

[1] https://wiki.archlinux.org/index.php/GNOME_Keyring



It came to my notice a few days ago that Gnome stored my Google Password in Gnome Keyring as simple text.


How did you come to this conclusion? If you've found a bug, please file a ticket.

Gnome keyring definitely uses encryption to store passwords; they take security pretty seriously: https://live.gnome.org/GnomeKeyring/SecurityPhilosophy


I think what he meant was seahorse. I just tried it out and I can see my raw passwords by clicking properties and ticking 'Show Password'. Shocked as well, not to mention seahorse is launched without asking my password.


> I can see my raw passwords by clicking properties and ticking 'Show Password'.

As opposed to what? They need to have access to the plaintext passwords somewhere; it's just encrypted when it's stored on disk.

> Shocked as well, not to mention seahorse is launched without asking my password.

The default keychain uses your login password, and it's unlocked at login. This is easy to change if you want to have to unlock it every time you use it.


This isn't shocking; Mac OS X will also happily show you your passwords. It stores them encrypted, then decrypts them for you after your keychain is unlocked.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: