Re: [gcmd-dev] [NEW] Use of GNOME authentication manager for user's security credentials

[Magnus Stålnacke]

Michael wrote:
> > The rev #1200 changes that. There has been added direct dependency on
> > gnome keyring (aka gnome auth. manager/daemon) what makes gcmd unusable
> > in non-gnome environments. This is BAD.
>
> ACK (although the ida was from me) i always was opting for independnence 

I am not using a gnome env. either (IceWm) and i
like to have a very short list of daemons running.

And like you i am not using graphical login managers,
just a script in my .profile that checks the runlevel
if it shall run startx or not (based on "who -r").
> It's easy to support his objections. eg, passwords in several places mean they 
> are more hard to detect, to steal. Where *one* secutiry hole in gkd could screw 
> it all up.

I did not think so much about "stealing" as i thought
of misshaps, bugs, chrashes or whatever making all user/passw
to up in smoke at the same time. As you say, the important
ones is saved elseware, sometimes even on paper. One
or two lost unimportant ones are no big deal, it is
just a matter of getting new ones. But to loose them
all in the same misshap is a major pain. That was what
i was thinking when i said "all eggs in the same basket".

But of course there are a stealing aspect too, but i
think that aspect should be handled in other ways.
I mean; if someone can read your private files, no
matter if they are plain text or not, you are screwed
anyway, an attacker should not get that far.