Post #3313531

I think you are absolutely right to examine whether your system defaults to too much convenience versus security for your threat model. For GNOME keyring: Any application can easily read any secret if the keyring is unlocked. And, if a user is logged in, then the login/default collection is unlocked. Available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used by default and would be easy to bypass anyway. The GNOME project disagrees with this vulnerability report because, according to their stated security model, untrusted applications must not be allowed to communicate with the secret service. Applications sandboxed via Flatpak only have filtered access to the session bus. https://wiki.archlinux.org/title/GNOME/Keyring#Security So while flatpaks that play the game are ok everything else is on trust. For the average user perhaps this is the right balance, though your Signal example suggests it’s too lax for anyone nowadays. I would like to see system secrets protected however they are accessed, not just for flatpaks.