It was found that kwallet, a tool for managing the passwords on a KDE system, uses Blowfish to encrypt its password store, and despite an attempt at implementing CBC mode (in a file called cbc.cc no less), it's actually ECB mode. UTF-16 encoding combined with Blowfish's 64 bit block size means there are just four password characters per block. Encryption is convergent as well.

The risk is that this may enable recovery of passwords through codebook attacks.

References: http://seclists.org/oss-sec/2014/q1/2 http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/