What I don't understand is if I want to access a particular password from keychain I have to enter my master password. But if I let someone use my machine for a few moments all they have to do is hit "Always Allow" and they can have all my passwords? That is jacked up, Apple.
Security Flaw in OS X displays all keychain passwords in plain text
31–40 of 57 posts
Re: Security Flaw in OS X displays all keychain passwords in plain text
#32This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…
Also, this ability to parse all the passwords unencrypted isn't a flaw and it isn't new. I ran this very command maybe 5 or 6 years also. Granted I was shocked to see all my passwords dump unhashed but you have to enter the users password and it makes sense that is the computer needs the passwords unhashed, there should be a secure command to gain access to them.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#33As others have alluded to, this is the "Login" keychain--a keychain of usernames and passwords that are unlocked upon a user's login. This is by design, not a security flaw.
When I tested, I saw banking creds in the ask list. If I want those creds from keychain I have to type my master password. But for some reason if I want all the passwords using this method I just have to click 'Always Allow'. Jacked up.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#34This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…
I just replicated this and it is true for 10.11.5
[deleted]
Re: Security Flaw in OS X displays all keychain passwords in plain text
#35Earlier quoted context omitted.
how do you login
It's a huge difference to use system specific passwords on that specific system or to trust a properitary buggy system with passwords to other, potentially critical, services and infrastructure. Which IMO is purely negligently
Whenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it.
And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory somewhere.
At that point, I would trust an application that runs with privileges that not even root can get (thanks to 10.11's rootless mode) much more than any other application, even given the eventual security flaw.
This severely reduces the attack surface to only the keychain application itself and to the component that enforces the privileges, whereas in other cases any root-exploit will cause you to lose your passwords.
In the year of 10.11's existence, no security flaw has been found in either system integrity protection (= rootless mode) nor in keychain (the bug listed here isn't a bug. if you ask keychain to give you the password, it will have to give you the password or there would be zero point in even storing it in the first place)
Re: Security Flaw in OS X displays all keychain passwords in plain text
#36Newsflash: If you let someone into your house, they can steal anything in your home.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#37Earlier quoted context omitted.
It's a huge difference to use system specific passwords on that specific system or to trust a properitary buggy system with passwords to other, potentially critical, services and infrastructure. Which IMO is purely negligently
Whenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it. And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory som…
i dont even know which version i run, so no idea if i have to be scared or not. updates are way to painful to do regulary on a working dev machine. (lazy linux user here)
anyway i never saved a password, thats exactly my point. There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#38This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…
Also, this ability to parse all the passwords unencrypted isn't a flaw and it isn't new. I ran this very command maybe 5 or 6 years also. Granted I was shocked to see all my passwords dump unhashed but you have to enter the users password and it makes sense that is the computer needs the passwords unhashed, there should be a secure command to gain access to them.
Hashing keychain passwords would make no sense. You hash passwords when you want to check against them. When you actually need to retrieve them at some point, however, you encrypt them.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#39Earlier quoted context omitted.
Whenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it. And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory som…
i dont even know which version i run, so no idea if i have to be scared or not. updates are way to painful to do regulary on a working dev machine. (lazy linux user here) anyway i never saved a password, thats exactly my point. There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.
So how do you manage your passwords you have for multiple sites?
Re: Security Flaw in OS X displays all keychain passwords in plain text
#40I tried with locked keychain and it requires to enter your password (still something but not everything). This is something that Apple needs to address soon I think.
> still something but not everything
Instead of what? What do you propose would be better?