My system disk is full encrypted with luks. My Ubuntu logs in automatically, because I am the only user. But I still need to unlock my Gnome Keyring and I wonder, if there is any sense for that. Because I always unlock the keyring when I login, so it is always accessible while the computer is running. What if I would set the password to blank, what could be the security risks?

The only reason I can imagine is, if I would do any stupid like backing up the keyfile to a non encrypted device or sending it by mail, it would still be password locked. But I shouldn't do something like that anyway.

  • Any malicious program you run with this user account or root privileges. – allo Aug 17 '18 at 13:22
  • Just to add something to this, I think if you have identical login and keyring password, it's also irrelevant if they are good or not, because both (luks and keyring data) have similar attack chance. – João Paulo Sep 15 '18 at 21:37

There is no security risk to doing this, assuming the following are true:

  • Your disk encryption password is sufficiently strong to remain unbroken.
  • The keychain will always be open any time the encrypted disk is mounted.
  • You don't copy the keychain database to an unencrypted medium.

If you always and immediately unlock your keychain while the system is on, then there is no real benefit to encrypting it again, assuming you are using a sufficiently strong FDE password. The only real benefit to encrypting the keychain is if the database is stored on an otherwise unencrypted disk, or if you only unlock it when you need it (effectively preventing a malicious process from reading it until you enter the password, even if that malicious process has root).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.