The Password Manager Predicament
Ubuntu uses the GNOME Keyring (often referred to as Passwords and Keys or Seahorse) to securely store your saved passwords for web browsers, Wi-Fi networks, and SSH keys. By default, Ubuntu is configured to automatically unlock this default “Login” keyring the moment you log into your desktop environment using your user password. While this provides a seamless experience, it presents a security risk in shared environments. If you walk away from your desk and someone accesses your unlocked session, they have immediate, unobstructed access to all your stored credentials, as the keyring is already fully unlocked and ready to serve passwords to any requesting application.
Isolating the Keyring from the Login Sequence
To stop Ubuntu from automatically unlocking your central password keyring when you log in, you must change the keyring’s master password so that it no longer matches your user account password.
Open the GNOME application menu and search for Passwords and Keys (the underlying application is called Seahorse). Launch the application. In the left-hand sidebar, you will see a list of keyrings under the “Passwords” section. Look for the one named Login (it usually has an unlocked padlock icon next to it if you just logged in). Right-click on the “Login” keyring and select Change Password. A dialog will prompt you to enter your old password (this is your current Ubuntu login password). Enter it and click Continue. Next, it will ask for a new password. Enter a strong password that is different from your Ubuntu login password. Confirm the new password and click OK. Upon your next reboot and login, Ubuntu will no longer be able to automatically decrypt the keyring. When a browser or background service requests a saved password, a discrete popup will appear asking you to manually enter the new master keyring password, adding a vital layer of active authentication.