Results 1 to 10 of 413

Thread: Keyring passwords visible after login without second password prompt

Threaded View

  1. #1
    Join Date
    Mar 2009
    Location
    New Zealand
    Beans
    687
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Exclamation Keyring passwords visible after login without second password prompt

    Why is it that when I go to Applications > Accessories > Passwords and Encryption Keys I can click on Passwords, then expand 'login' and then I can see my passwords for my MSN account and wireless networks I connect to without once being prompted for my user password?

    But then when I change CPU Frequency scaling, I'm prompted to enter my admin password?

    O.o

    How to reproduce:

    1. Restart your computer and login. Do not enter any passwords after your desktop has loaded.

    2. Go to Applications > Accessories > Passwords and Encryption Keyrings

    3. Click on the 'Login' folder to drop down and view the programs that store data here.

    4. Double click on something you want to look at.

    5. Click Password to show some dots, then uncheck the box below the dots marked "Show password"

    6. Note that throughout this whole procedure, not once were you prompted* to enter in anything that verifies you are authorized to view this information.

    *The only prompt is asking if it's allowed access to the keyring, to which anyone can click allow.

    Links all in one place:

    Bug report filed on Launchpad
    OMG! UBUNTU! Blog Post
    Gnome-keyring mailing list
    Gnome Keyring Security Philosophy
    Ubuntu Brainstorm Idea




    -------
    Attached Images Attached Images
    Last edited by humphreybc; October 29th, 2009 at 04:43 AM.
    Writer for OMG! Ubuntu!, Editor-in-Chief Ubuntu Gamer. Co-founder of media and software company Ohso.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •