*** This bug is a security vulnerability ***
Public security bug reported:
Binary package hint: gnome-keyring
On Natty Beta 2 (all updates as of today 4/26), I wanted to change the
password for the "login" keyring in Seahorse so that it would be
different from the user password. I entered my old password (identical
to the user password) and then entered the new password twice. Then, to
test it, I locked the keyring and unlocked it later with my new
password. Everything worked as expected.
Then, on restart, I was prompted, as expected, with a screen to unlock
my keyring. I unlocked it with my new password and for example
connecting to the wifi network worked automatically. But then, just like
in bug #745780, after entering the new password, the prompt kept coming
up. But as in the bug described, there seemed no harm in canceling the
other prompts, so I did.
However, this is where it got interesting (hence the reason for this bug
report): upon rebooting again (or logging out and back in, for that
matter), the password prompt didn't appear at all anymore. So to figure
out what happened, I called up the keyring manager and found my "login"
keyring already unlocked (without me entering the password - only the
login password, but I had changed the keyring password to be something
different). Locking and then trying to unlock it again, I was greeted
with a prompt to enter the password, but my new password kept being
rejected. But entering my old login password, the keyring was suddenly
unlocked.
So I went ahead and repeated the entire procedure of changing the
password. As before, on the next login, I was able to unlock my keyring
with the new password (plus the excess prompts to enter the password
again). To check if this time everything was alright, I called up the
keyring manager again and locked and tried to unlock my keyring. This
time, it rejected my new password (after accepting it only moments
before!), and again the old password worked.
So it seems to me that the problem is the following: at some point, the
new password for the "login" keyring gets reset to the user's password.
I'm guessing it is related to the bug #745780 mentioned before, as this
only happens after canceling the excess prompts after a new login, since
on first login, the new password still works to unlock the keyring. But
I filed a new bug because I'm not sure if there's not more to this
problem.
I'm not sure if I managed to explain myself correctly, it's a really
weird problem, and I have no idea why the password would be reset.
Anyhow, if I can contribute any more information, just let me know.
(A limited workaround might be to create a new keyring and make it
default and leave the "login" keyring empty. I'll try that tomorrow.)
** Affects: gnome-keyring (Ubuntu)
Importance: Undecided
Status: New
** Visibility changed to: Public
** Description changed:
Binary package hint: gnome-keyring
On Natty Beta 2 (all updates as of today 4/26), I wanted to change the
password for the "login" keyring in Seahorse so that it would be
different from the user password. I entered my old password (identical
to the user password) and then entered the new password twice. Then, to
test it, I locked the keyring and unlocked it later with my new
password. Everything worked as expected.
Then, on restart, I was prompted, as expected, with a screen to unlock
my keyring. I unlocked it with my new password and for example
connecting to the wifi network worked automatically. But then, just like
- in <a href="https://bugs.launchpad.net/bugs/745780";>bug #745780</a>,
- after entering the new password, the prompt kept coming up. But as in
- the bug described, there seemed no harm in canceling the other prompts,
- so I did.
+ in bug #745780, after entering the new password, the prompt kept coming
+ up. But as in the bug described, there seemed no harm in canceling the
+ other prompts, so I did.
However, this is where it got interesting (hence the reason for this bug
report): upon rebooting again (or logging out and back in, for that
matter), the password prompt didn't appear at all anymore. So to figure
out what happened, I called up the keyring manager and found my "login"
keyring already unlocked (without me entering the password - only the
login password, but I had changed the keyring password to be something
different). Locking and then trying to unlock it again, I was greeted
with a prompt to enter the password, but my new password kept being
rejected. But entering my old login password, the keyring was suddenly
unlocked.
So I went ahead and repeated the entire procedure of changing the
password. As before, on the next login, I was able to unlock my keyring
with the new password (plus the excess prompts to enter the password
again). To check if this time everything was alright, I called up the
keyring manager again and locked and tried to unlock my keyring. This
time, it rejected my new password (after accepting it only moments
before!), and again the old password worked.
So it seems to me that the problem is the following: at some point, the
new password for the "login" keyring gets reset to the user's password.
- I'm guessing it is related to the <a
- href="https://bugs.launchpad.net/bugs/745780";>bug #745780</a> mentioned
- before, as this only happens after canceling the excess prompts after a
- new login, since on first login, the new password still works to unlock
- the keyring. But I filed a new bug because I'm not sure if there's not
- more to this problem.
+ I'm guessing it is related to the bug #745780 mentioned before, as this
+ only happens after canceling the excess prompts after a new login, since
+ on first login, the new password still works to unlock the keyring. But
+ I filed a new bug because I'm not sure if there's not more to this
+ problem.
I'm not sure if I managed to explain myself correctly, it's a really
weird problem, and I have no idea why the password would be reset.
Anyhow, if I can contribute any more information, just let me know.
(A limited workaround might be to create a new keyring and make it
default and leave the "login" keyring empty. I'll try that tomorrow.)
--
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to gnome-keyring in Ubuntu.
https://bugs.launchpad.net/bugs/770663
Title:
New keyring password keeps being reset
--
desktop-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
