New issue
Advanced search Search tips

Issue 686880 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Fedora 25: Chrome 56 stores passwords internally, not in gnome-keyring

Reported by nateggra...@gmail.com, Jan 30 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Steps to reproduce the problem:
1. Install Fedora 25 with GNOME 3.22
2. Upgrade to Chrome 56 from Chrome 55
3. Navigate to a website that requires login credentials
4. Log in and tell Chrome to save the password when prompted
5. Open gnome-keyring and search for the password

What is the expected behavior?
The password should be saved in gnome-keyring, like it was in Chrome 55 and all prior versions of Chrome.

What went wrong?
Instead, the password is saved in Chrome's internal password manager. Same thing happens when trying to read passwords: passwords saved in gnome-keyring are not recognized.

Did this work before? Yes Chrome 55

Chrome version: 56.0.2924.76  Channel: stable
OS Version: Fedora 25, GNOME 3.22
Flash Version: Shockwave Flash 24.0 r0

Chromium 55 is still able to read from and write to gnome-keyring, so it doesn't appear to be an issue with gnome-keyring, GNOME, or GTK.

 
Update: this only happens when Chrome is run with XWayland (i.e. in a Wayland session). Chrome 56 is able to read and write passwords to and from gnome-keyring when logging into an Xorg session.

Comment 2 by est...@chromium.org, Jan 30 2017

Cc: vabr@chromium.org engedy@chromium.org
Components: UI>Browser>Passwords
engedy, do you know if there were any changes recently with how passwords are stored on Linux?
Is this related to changes in https://bugs.chromium.org/p/chromium/issues/detail?id=602624 ?

Comment 4 by engedy@chromium.org, Jan 30 2017

Cc: cfroussios@chromium.org
Adding Christos who worked on this. 
It sounds like either Chrome stopped expecting to find gnome-keyring in this linux distribution, or it fails to load the keyring libraries.

Let's examine the easy part first. If you run Chrome with --password-store=gnome, does still ignore keyring?

Also, what's the state of the gnome-keyring in question? Does it auto-unlock, or is it unlock manually via a prompt? If it is manual, do you still get prompt(s) after the update?
...And just like that, after rebooting into a Wayland session to test, I can no longer reproduce the issue. The only system change I made since reporting the issue was fixing https://bugzilla.redhat.com/show_bug.cgi?id=1417431. Could that have caused it?

Comment 7 by xzhou@chromium.org, Feb 2 2017

Labels: Security_Severity-Medium Security_Impact-Stable

Comment 8 by kenrb@chromium.org, Feb 2 2017

Did anybody manage to reproduce this issue locally?
Project Member

Comment 9 by sheriffbot@chromium.org, Feb 3 2017

Labels: M-57
Project Member

Comment 10 by sheriffbot@chromium.org, Feb 3 2017

Labels: -Pri-2 Pri-1

Comment 11 by vabr@chromium.org, Feb 3 2017

Cc: -vabr@chromium.org
Labels: Hotlist-Polish
Removing myself, because cfroussios@ is the best person to talk to about this. Happy to get re-involved on demand, though.
Owner: cfroussios@chromium.org
Status: Assigned (was: Unconfirmed)
cfroussios@, could you help triage this bug? 
If nobody can repro it anymore, please feel free to mark it won't fix. Thanks!
Status: WontFix (was: Assigned)
I didn't repro. Since there is only one report of this and it fixed itself, we can't investigate further.
Project Member

Comment 14 by sheriffbot@chromium.org, May 17 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment