Since KWallet is still the default password manager in KDE, I think this deserves an update. ## Current Status, Apr 2021 The security bugs originally discussed in this question and the answers from 2013 (particularly [Tom Leek's answer](https://security.stackexchange.com/a/44010/255524)) are disclosed in [CVE-2013-7252][cve-2013-7252], which links back to the same [blog post](http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/) that was referenced in this question, which itself links back to Tom Leek's analysis here. **These issues have since been addressed.** In particular, [GPG support was added in `kde-runtime` 4.12, the password encryption was improved in 4.13][bugzilla-1048169-c4], and [the ECB/CBC issue was addressed in KDE Applications 14.12.1 and KF5::KWallet 5.6.0][kde-security-advisory-20150109-1]. (Note: As I understand, in the latter link, "kde-runtime KWallet" refers to the older "KWallet 4", and "KF5::KWallet" refers to the newer "KWallet 5".) Modern KWallet *should* not have these vulnerabilities, at least when [using the GPG support][taming-kwallet-gpg] ([this post][askubuntu-gpg-kwallet] suggests using Kleopatra instead KGPG to set this up). But that is not to say there aren't any **other vulnerabilities**. For example: 1. The password database and GUI manager are unlocked together. While the DB is unlocked, no additional password is required to view the stored passwords. Anyone with access to the PC can view *every* stored password as plain text via the GUI. This is made worse by the common practice of leaving it unlocked for the entire duration of a user's session. 1. Likewise, the DB itself is stored as plain text while its unlocked. During this time, the DB security is only as good as the filesystem security (and in fact worse, due to other access options such as point 1 above). 1. Any application can query the DB via CLI, and there's no isolation between different applications' passwords. So a malicious application [can potentially query another application's password](https://forum.kde.org/viewtopic.php?t=151088#p400373). (To be fair, this is [likely a problem with other password stores as well](https://bbs.archlinux.org/viewtopic.php?pid=1759196#p1759196).) 1. When an application requests access to the wallet, the message is not always clear on *which* application is attempting access. So it can be difficult to tell if it's a legitimate request. Furthermore, it's easy to impersonate a valid application for such requests. 1. It was, and likely still is, [vulnerable to keylogger and `ptrace` attacks](https://mail.kde.org/pipermail/plasma-devel/2016-July/055645.html). [This thread from 2016][plasma-devel-055641] on the Plasma-devel mailing list provides more details. Some of these can be reduced at the cost of some user convenience, by disabling auto-unlocking, enabling auto-locking, and requiring a prompt each time an application tries to access the wallet. In addition, **don't store highly-sensitive secrets together with your application passwords**, and **use two-factor-authentication for the really sensitive stuff** like your email (which can be used to reset many of your other passwords), bank account/website, and credit card/website passwords. **PAM auto-unlock:** Auto-unlock itself already reduces security as noted above, but [according to ArchWiki][archwiki-pam-unlock], it's actually worse: > - [kwallet-pam](https://archlinux.org/packages/?name=kwallet-pam) is not compatible with [GnuPG](https://wiki.archlinux.org/index.php/GnuPG) keys, the KDE Wallet must use the standard `blowfish` encryption. > - The wallet must be named `kdewallet` (default name). It does not unlock any other wallet(s). So you get *either* GPG *or* auto-unlock, not both; and the default wallet name is easy for a malicious script to guess (though the script could just run `ls` on the wallets folder anyway). ## KSecretsService, QtKeyChain, `libsecret` Back in the day, there was an attempt to replace KWallet with [KSecretsService][ksecretsservice], aka [KSecrets][ksecrets]. This was an implementation of the [FreeDesktop Secret Service API draft][freedesktop-secret-service], which is also implemented by [GNOME Keyring](https://wiki.gnome.org/Projects/GnomeKeyring). But this was abandoned due to lack of developer time, and newer developments in the Linux ecosystem. This was [discussed on the Plasma-devel mailing list][plasma-devel-055641], and the consensus seemed to be to migrate the KDE apps to [QtKeyChain](https://github.com/frankosterfeld/qtkeychain), which would separate the API from the backend implementation. I don't know if that decision was followed, but given the [level of activity on QtKeyChain][qtkeychain-commits], that seems like a reasonable assumption ([this post](https://forum.kde.org/viewtopic.php?f=15&t=156925#p410206) somewhat confirms that as well). A few months later, QtKeyChain [added support for `libsecret`][qtkeychain-pull-62], which is also based on FreeDesktop Secret Service (included since QtKeyChain 0.8). More recently, `libsecret` [is now required](https://github.com/frankosterfeld/qtkeychain/commit/a1aef5b415e75801973053426cf8babfb10c22b3) by QtKeyChain (unless disabled). `libsecret` itself [is a replacement for `libgnome-keyring`][lwn-490518] (but [with no GNOME dependencies][ubuntu-focal-libsecret]), so GNOME applications should also be migrating to `libsecret`. ## KeePassXC and KDE Integration [KeePassXC](https://keepassxc.org/) is the modern successor of KeePassX, itself a Linux port of [KeePass](https://keepass.info/). KeePassXC is cross-platform via Qt5. It [added `libsecret` support][keepassxc-pull-2726] as of version 2.5.0 (2019). *Theoretically* (haven't tested this myself yet), this should allow KDE apps to communicate with KeePassXC, *if those KDE apps use QtKeyChain*. (note: KeePassXC [have done some work towards client isolation](https://github.com/keepassxreboot/keepassxc/pull/2726#issuecomment-821824043), but it's not a complete solution yet.) **Update, Aug 2022:** Intiall support for the Secret Service API was [added to KWallet in KDE Frameworks 5.97.0](https://kde.org/announcements/frameworks/5/5.97.0/#kwallet-framework). ## Disclaimer I AM NOT A SECURITY EXPERT. The information provided herein is merely a summary of what I found with Google. I am not responsible for any damages, loss of data or finances, security breaches, inconvenience, and so forth, resulting from your use of the information or advice provided herein. USE AT YOUR OWN RISK. ## References 1. [CVE-2013-7252][cve-2013-7252] 1. [Bug 1048169 - CVE-2013-7252 kwallet: crypto misuse [fedora-all] - Bugzilla][bugzilla-1048169-c4] 1. [KDE Security Advisory 9 January 2015][kde-security-advisory-20150109-1] 1. [The situation of KWallet, and what to do about it? - Plasma-devel mailing list, 2016][plasma-devel-055641] 1. [How secure kwallet is - KDE Forum][kde-forum-151088] 1. [Taming KDEwallet: Using GPG - Thoughts on computing][taming-kwallet-gpg] 1. [Unable to configure Kgpg kwalletmanager - AskUbuntu][askubuntu-gpg-kwallet] 1. [Unlock KDE Wallet automatically on login - ArchWiki][archwiki-pam-unlock] 1. [KSecretsService - KDE.org][ksecretsservice], [KSecrets - GitHub][ksecrets] 1. [Secret Service API Draft - FreeDesktop.org][freedesktop-secret-service] 1. [Libsecret revealed - LWN.net][lwn-490518] 1. [`libsecret` in Focal - Ubuntu Packages][ubuntu-focal-libsecret] 1. [QtKeyChain commits history - GitHub][qtkeychain-commits] 1. [QtKeyChain PR62: Added libsecret support - GitHub][qtkeychain-pull-62] 1. [KeePassXC PR2726: Implement Freedesktop.org Secret Storage - GitHub][keepassxc-pull-2726] [cve-2013-7252]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7252 [bugzilla-1048169-c4]: https://bugzilla.redhat.com/show_bug.cgi?id=1048169#c4 [kde-security-advisory-20150109-1]: https://kde.org/info/security/advisory-20150109-1.txt [plasma-devel-055641]: https://mail.kde.org/pipermail/plasma-devel/2016-July/055641.html [kde-forum-151088]: https://forum.kde.org/viewtopic.php?t=151088 [taming-kwallet-gpg]: https://nwrickert2.wordpress.com/2016/08/19/taming-kdewallet/#gpg [askubuntu-gpg-kwallet]: https://askubuntu.com/a/1158139/1193612 [archwiki-pam-unlock]: https://wiki.archlinux.org/index.php/KDE_Wallet#Unlock_KDE_Wallet_automatically_on_login [ksecretsservice]: https://community.kde.org/KDE_Utils/ksecretsservice [ksecrets]: https://github.com/KDE/ksecrets [freedesktop-secret-service]: https://specifications.freedesktop.org/secret-service/latest/ [lwn-490518]: https://lwn.net/Articles/490518/ [ubuntu-focal-libsecret]: https://packages.ubuntu.com/focal/libsecret-1-0 [qtkeychain-commits]: https://github.com/frankosterfeld/qtkeychain/commits/master [qtkeychain-pull-62]: https://github.com/frankosterfeld/qtkeychain/pull/62 [keepassxc-pull-2726]: https://github.com/keepassxreboot/keepassxc/pull/2726