5 ms·

This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers w

This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers when they're available. If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. (On Windows and OS X, it uses CryptProtectData and the Keychain API, respectively.) https://code.google.com/p/chromium/wiki/LinuxPasswordStorage https://code.google.com/p/chromium/wiki/LinuxPasswordStorage

__mp 11y ago
I wonder how many people are using KDE or Gnome these days. I'm pretty sure I'm using something other than KDE and Gnome on my Linux installs.
- keithpeter 11y ago
  Debian Popularity Contest can tell you a few things... Just over half of those participating have installed Gnome/KDE/Cinnamon https://qa.debian.org/popcon-graph.php?packages=gnome-shell%2C+gnome-panel%2C+cinnamon%2C+xfce4-panel%2C+kde-workspace-bin&show_installed=on&want_percent=on&want_legend=on&want_ticks=on&from_date=2015-01-01&to_date=2015-06-14&hlght_date=&date_fmt=%25Y-%25m&beenhere=1 https://qa.debian.org/popcon-graph.php?packages=gnome-shell%... And it looks as if about a quarter totally are using Gnome/KDE/Cinnamon regularity (rest could be switched off of course!) https://qa.debian.org/popcon-graph.php?packages=gnome-shell%2C+gnome-panel%2C+cinnamon%2C+xfce4-panel%2C+kde-workspace-bin&show_vote=on&want_percent=on&want_legend=on&want_ticks=on&from_date=2015-01-01&to_date=2015-06-14&hlght_date=&date_fmt=%25Y-%25m&beenhere=1 https://qa.debian.org/popcon-graph.php?packages=gnome-shell%... Popcon statistics are notoriously hard to interpret though so a large pinch of salt needed. https://joeyh.name/blog/entry/the_popcon_problem/ https://joeyh.name/blog/entry/the_popcon_problem/
nly 11y ago
Here's a question: why isn't there a de facto desktop independent password/key/secret manager for Linux? The Linux kernel has userland crypto apis built-in, why aren't we using them? At most, only the manager/permissions UI should be desktop dependent.
- krakensden 11y ago
  There is- it's called libsecret, and it's used as a cross-platform backend for both the Gnome & KDE secret managers, which are 'just' guis for it. I don't actually know if it uses the Linux kernel's apis, but it's supposed to do a pretty good job.
  - nly 11y ago
    KWallet in KDE4 doesn't seem to be using libsecret. Is this a KDE 5.x thing?
    - dd9990 11y ago
      It's being called KSecret Service afaik (https://barlog.rusu.info/valentin/blog/?p=411 https://barlog.rusu.info/valentin/blog/?p=411).
      - runiq 11y ago
        And it still uses libsecret under the hood.
  - mhogomchungu 11y ago
    The biggest issue with libsecret and with KWallet is that once a wallet is opened by one application,every other application can get all the contents of that opened wallet. In GNOME,the wallet is opened by the login manager and that means all the contents of the wallet are available to all processes run from the logged in user account. KDE refused to have the above behavior of the login manager opening the wallet and hence after login,there must be atleast one application that will have to open the wallet and then the behavior will be the same as libsecret. Lots of people who use these two storage systems are not aware of the above. I dont like the above behavior as i want each application to manage its own private wallet and i created lxqt_wallet[1] to give me the behavior i want. The project also supports libsecret and KWallet for those who prefer these backends. [1] https://github.com/mhogomchungu/lxqt_wallet https://github.com/mhogomchungu/lxqt_wallet
justinschuh 11y ago
That's a bit out of date, because libsecret is supported as well: https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/password_manager/native_backend_libsecret.h https://code.google.com/p/chromium/codesearch#chromium/src/c... But yeah, it pretty much looks for any sort of secure credential manager and falls back to the fixed key only when nothing is available.
wtbob 11y ago
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable password should live outside of a computer under the user's physical control. Thus, passwords (and other private data) on remote systems should always be encrypted with secure keys, themselves generated on the user's device and encrypted on his device with his memorable password. The facts that by default Google will store your website and WiFi passwords (along with your emails and pictures) in plaintext on their servers, and that Mozilla utterly destroyed the security of their sync system, are utterly sickening.
- newuser88273 11y ago
  Expecting privacy (or privacy-preserving security) from Google products has always been folly. Mozilla used to be different. However, when Brendan was purged, first doubts may have arisen. Now that we also see cyber-bully Klabnik on their payroll, the probability has risen sharply that Mozilla has been successfully subverted into a political pressure group. Since Mozilla now is enrolled in support of the dominant ideology, it has no incentive for supporting privacy anymore, either: The dominant ideology wants minority opinion holders to be outed and ostracised.
  - lolpep8 11y ago
    How could I not think of that! Hiring a kind of SJW-ey guy to write Rust docs is just a small step in the direction of clear-text passwords and the removal of HTTPS from Firefox. Better switch to Gnome Web, then.
    - newuser88273 11y ago
      If Mozilla was a-political, Klabnik couldn't work there if Brendan couldn't. He can, and Mozilla isn't. Actually, the politicalization of Mozilla means that everything technical will lose priority over time.
erikb 11y ago
I'm not good at security stuff, but is a hardcoded password not much worse than any string written to some kind of config database but that is different for every program installation or system user?
- sorbits 11y ago
  It’s about the same, as anyone would be able to read the generated password from the config database (since where to store it would still be hardcoded in the binary).

__mp 11y ago

I wonder how many people are using KDE or Gnome these days. I'm pretty sure I'm using something other than KDE and Gnome on my Linux installs.

keithpeter 11y ago
Debian Popularity Contest can tell you a few things... Just over half of those participating have installed Gnome/KDE/Cinnamon https://qa.debian.org/popcon-graph.php?packages=gnome-shell%2C+gnome-panel%2C+cinnamon%2C+xfce4-panel%2C+kde-workspace-bin&show_installed=on&want_percent=on&want_legend=on&want_ticks=on&from_date=2015-01-01&to_date=2015-06-14&hlght_date=&date_fmt=%25Y-%25m&beenhere=1 https://qa.debian.org/popcon-graph.php?packages=gnome-shell%... And it looks as if about a quarter totally are using Gnome/KDE/Cinnamon regularity (rest could be switched off of course!) https://qa.debian.org/popcon-graph.php?packages=gnome-shell%2C+gnome-panel%2C+cinnamon%2C+xfce4-panel%2C+kde-workspace-bin&show_vote=on&want_percent=on&want_legend=on&want_ticks=on&from_date=2015-01-01&to_date=2015-06-14&hlght_date=&date_fmt=%25Y-%25m&beenhere=1 https://qa.debian.org/popcon-graph.php?packages=gnome-shell%... Popcon statistics are notoriously hard to interpret though so a large pinch of salt needed. https://joeyh.name/blog/entry/the_popcon_problem/ https://joeyh.name/blog/entry/the_popcon_problem/

nly 11y ago

Here's a question: why isn't there a de facto desktop independent password/key/secret manager for Linux? The Linux kernel has userland crypto apis built-in, why aren't we using them? At most, only the manager/permissions UI should be desktop dependent.

krakensden 11y ago
There is- it's called libsecret, and it's used as a cross-platform backend for both the Gnome & KDE secret managers, which are 'just' guis for it. I don't actually know if it uses the Linux kernel's apis, but it's supposed to do a pretty good job.
- nly 11y ago
  KWallet in KDE4 doesn't seem to be using libsecret. Is this a KDE 5.x thing?
  - dd9990 11y ago
    It's being called KSecret Service afaik (https://barlog.rusu.info/valentin/blog/?p=411 https://barlog.rusu.info/valentin/blog/?p=411).
    - runiq 11y ago
      And it still uses libsecret under the hood.
- mhogomchungu 11y ago
  The biggest issue with libsecret and with KWallet is that once a wallet is opened by one application,every other application can get all the contents of that opened wallet. In GNOME,the wallet is opened by the login manager and that means all the contents of the wallet are available to all processes run from the logged in user account. KDE refused to have the above behavior of the login manager opening the wallet and hence after login,there must be atleast one application that will have to open the wallet and then the behavior will be the same as libsecret. Lots of people who use these two storage systems are not aware of the above. I dont like the above behavior as i want each application to manage its own private wallet and i created lxqt_wallet[1] to give me the behavior i want. The project also supports libsecret and KWallet for those who prefer these backends. [1] https://github.com/mhogomchungu/lxqt_wallet https://github.com/mhogomchungu/lxqt_wallet

justinschuh 11y ago

That's a bit out of date, because libsecret is supported as well: https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/password_manager/native_backend_libsecret.h https://code.google.com/p/chromium/codesearch#chromium/src/c... But yeah, it pretty much looks for any sort of secure credential manager and falls back to the fixed key only when nothing is available.

wtbob 11y ago

> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable password should live outside of a computer under the user's physical control. Thus, passwords (and other private data) on remote systems should always be encrypted with secure keys, themselves generated on the user's device and encrypted on his device with his memorable password. The facts that by default Google will store your website and WiFi passwords (along with your emails and pictures) in plaintext on their servers, and that Mozilla utterly destroyed the security of their sync system, are utterly sickening.

newuser88273 11y ago
Expecting privacy (or privacy-preserving security) from Google products has always been folly. Mozilla used to be different. However, when Brendan was purged, first doubts may have arisen. Now that we also see cyber-bully Klabnik on their payroll, the probability has risen sharply that Mozilla has been successfully subverted into a political pressure group. Since Mozilla now is enrolled in support of the dominant ideology, it has no incentive for supporting privacy anymore, either: The dominant ideology wants minority opinion holders to be outed and ostracised.
- lolpep8 11y ago
  How could I not think of that! Hiring a kind of SJW-ey guy to write Rust docs is just a small step in the direction of clear-text passwords and the removal of HTTPS from Firefox. Better switch to Gnome Web, then.
  - newuser88273 11y ago
    If Mozilla was a-political, Klabnik couldn't work there if Brendan couldn't. He can, and Mozilla isn't. Actually, the politicalization of Mozilla means that everything technical will lose priority over time.

erikb 11y ago

I'm not good at security stuff, but is a hardcoded password not much worse than any string written to some kind of config database but that is different for every program installation or system user?

sorbits 11y ago
It’s about the same, as anyone would be able to read the generated password from the config database (since where to store it would still be hardcoded in the binary).