You are not logged in.

Dear visitor, welcome to If this is your first visit here, please read the Help. It explains in detail how this page works. To use all features of this page, you should consider registering. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.


Tuesday, December 25th 2007, 9:42pm

KDEWallet insecurely displaying passwords via GUI to anyone around

Is there a way to make kdewallet not to display (to anyone) passwords when that particular wallet is open (in use by an app)?

For example, I have kwallet to store my kopete passwords. I usually have kopete running so theat wallet is open too almost all the time I have my laptop turned on. In this situation anyone (ie while I go to the toilet) can view all my passwords stored on kwallet:

Kmenu -> Setting -> Security & Privacy -> KDE wallet -> Launch Wallet Managet -> Open wallet (as the wallet is open it doesn't ask for a password!) and voilá, you can have access to see, read and copy ALL my passwords! (ie to see kopete passwords: Kopeete -> passwords -> account x -> Show contents)

If you remove kwalletmanager in access control from that wallet you can do the same, the only additional step is that you (anyone) have to Allow acces (once or allways) when prompted, but you can still get to the passwords to be displayed gracefully written... so what is the utility of encryption if the passwords are accessible via GUI?

Shouldn't this be password protected? ie on firefox even after you input the master password for the password manaager, if you go to the preferences and try to "show passwords" you are prompted for the master password to display them (I belive that is to prevent situations like the one I'm describing here with kde wallet).

PS: Using Kubuntu Gutsy 7.10, KDE 3.5.8, KDE Wallet Manager 1.1



Posts: 53

Location: Romania

  • Send private message


Tuesday, January 8th 2008, 9:45pm

Yes, this could be a misfeature, please report a bug.
But do notice that what the kde wallet does is different from what firefox does. Firefox only keeps its own passwords, while the KDE wallet provides other programs with passwords.


Tuesday, January 8th 2008, 10:15pm

Yep, I know the difference with firefox password manager and KDEWallet, but I was mentioning as an example to ask for the Master Password/Wallet Password to visually display the passwords on screen.

I haven't submitted a bug because I thought I was doing something wrong...

I'll submit a bug report then, thanks,