oh no! wifi passwordsare stored in plain text!

ppurka · Advocate Joined: 26 Dec 2004 Posts: 3246

http://www.itworld.com/open-source/397843/did-ubuntu-goof-storing-wi-fi-passwords-clear-text

That is so incredibly bad! Now we need a pass-me-the-word-kit (pmtwkit) that will securely store our wifi passwords using 16384 bit one-way encryption. This will be futuristic kit using which networkmanager will be able to query for the password using dbus and pmtwkit will return you the password via dbus.

However, there is just one problem. All these low level wpa_supplicant, dhcpcd do not understand dbus and so do not fit this model. Dbus-aware networking component should be integrated with systemd to efficiently and transparently talk over dbus with networkmanager. After these changes wpa_supplicant, dhcp clients, etc will not be supported anymore. In the far future, we in fact need to merge nm into systemd so that there is no need to even use dbus. At that point we can deprecate pmtwkit.
_________________
emerge --quiet redefined | E17 vids: I, II | Now using e from git | e18, e19, and kde4 sucks :-/

Muso

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1593 Location: U.S.A.

ppurka · Advocate Joined: 26 Dec 2004 Posts: 3246

salahx · Guru Joined: 12 Mar 2005 Posts: 428

The files (though not the directory itself) /etc/NetworkManager/system-connection has permissions of 600, so only root can read them anyway. So this is a non-concern.

Second, pmtwkit already exists (although i am unsure if its been implemented or not) - http://freedesktop.org/wiki/Specifications/secret-storage-spec/ . Although that service is a per-user service, it would make less sense to create a system one since the user keyring are encrypted using the user's password, no such password exists (unless the system has a TPM or similar) on the system so it no better than what's already being done now.

wswartzendruber · Veteran Joined: 23 Mar 2004 Posts: 1240 Location: ID, USA

I'm also trying to understand what the big deal is.

pjp

Greens · n00b Joined: 23 Aug 2013 Posts: 27

It actually requires root access to read it.

If someone suspicious has root access to your computer or is sitting there booting a livecd to look at your unencrypted disk, I don't think they care much about your wifi password, maybe they'd check it to see if your using it for anything else.

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1593 Location: U.S.A.

Yeah, fuck it.

Naib · Posted: Sun Dec 29, 2013 8:55 pm Post subject:

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1593 Location: U.S.A.

Yeah, that's all the security anybody needs: root access or no root access.

ppurka · Advocate Joined: 26 Dec 2004 Posts: 3246

I guess the ubuntu guys panic because of the bad way sudo is (mis)configured in their systems - any command can be run with sudo, and once credentials are provided, the user remains authenticated for about 15 or so minutes.

Ideally, they either should enable sudo only for some very specific applications by default (package manager, system settings like time, etc), OR they should simply not enable sudo with a timeout. Ask for the user password every single time one needs to access anything using sudo.
_________________
emerge --quiet redefined | E17 vids: I, II | Now using e from git | e18, e19, and kde4 sucks :-/