Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Flaw in OS X displays all keychain passwords in plain text

medium.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Security Flaw in OS X displays all keychain passwords in plain text

#41

Post by jrochkind1 »

herbst wrote: post #37
pilif wrote: post #35

Earlier quoted context omitted.

Whenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it. And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory som…

i dont even know which version i run, so no idea if i have to be scared or not. updates are way to painful to do regulary on a working dev machine. (lazy linux user here) anyway i never saved a password, thats exactly my point. There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.

> There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.

How do you believe that differs from any other cloud manager, local or cloud-hosted? What reason(s) do you have to believe they can be fully trusted? Or do you not use password managers at all? I assume you don't re-use passwords from site to site (because there's also no single reason to believe any particular site you log into can be fully trusted with a password you've used accross sites), I assume you use secure passwords (because you clearly prioritize security)... how do you remember them all?

Re: Security Flaw in OS X displays all keychain passwords in plain text

#42

Post by Karunamon »

merpnderp wrote: post #30
cocotino wrote: post #22

This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…

I just replicated this and it is true for 10.11.5

Replicated it succeeding, or failing? It isn't possible to script the security window; the scripting system can't even see it.

http://prntscr.com/bqepwk

Re: Security Flaw in OS X displays all keychain passwords in plain text

#43

Post by Karunamon »

coldcode wrote: post #10
csydas wrote: post #7

Earlier quoted context omitted.

Snippet from the man page for security: https://developer.apple.com/legacy/library/documentation/Dar... >dump-keychain [-adhir] Dump the contents of one or more keychains. -a Dump access control list of items -d Dump (decrypted) data of items -i Interactive access control list editing mode -r Dump raw (encrypted) data of items I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dum…

dump-keychain: command not found

The name of the main command is 'security', with 'dump-keychain' being an argument.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#44

Post by eeeeeeeeeeeee »

cocotino wrote: post #22

This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…

Yep, just tested this myself and was immediately prompted for my password. No sensitive data was exposed if I simply clicked "deny."

Re: Security Flaw in OS X displays all keychain passwords in plain text

#45

Post by brenton07 »

eeeeeeeeeeeee wrote: post #44
cocotino wrote: post #22

This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…

Yep, just tested this myself and was immediately prompted for my password. No sensitive data was exposed if I simply clicked "deny."

We tested this on four machines and had no prompts for password authentication. Two of them are VERY close to clean installs with only Adobe CC and two or three other production software components installed, highest security settings for everything in preferences.

We haven't been able to figure out why some users are prompted and others are not.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#46

Post by brenton07 »

gilgoomesh wrote: post #15
jmiserez wrote: post #8

That only allows exporting the passwords of the currently logged-in user. If you let someone untrusted (!) log in remotely to your computer with your user account or you give it to someone while your user is logged in it's your own fault if your keys get stolen. You should use a guest account with restricted privileges or a separate machine. It's not much different on Linux, if you use Gnome-Keyring (used by default…

Simply being logged in is not sufficient. The only way this should be possible on the Mac is if a logged in user physically at the computer selects "Allow" or "Always allow" for each security dialog that appears. Remote sessions are not permitted to do this. Security dialogs cannot be scripted under normal circumstances (the AppleScript given in the article simply doesn't work). I suspect it might be possible to do h…

I was actually the author of this article, and am about to update it to address some of the criticisms. We have two machines locked down to only certain functions, down to only certain IP addresses even being allowed to communicate with the machines, and still managed to execute this - it did prompt Allow/Deny windows, but I find that intellectually different than a lack of password prompt.

I have dug through security preferences extensively and can't see what setting could be changed or updated to disallow this function.

I've updated the article to address and respond to some of the criticisms and feedback.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#47

Post by brenton07 »

rangibaby wrote: post #26
dfraser992 wrote: post #17

Earlier quoted context omitted.

On 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.

The new security was added in 10.11 afaik

Wonder if it got bumped on accident on a recent update. My system has been modified to allow system access, so its less surprising (although still a flaw). But we did it on machines by people that are probably TOTALLY unaware of those 10.11 changes and wouldn't have the know how to modify something like that, and it still worked on their machines.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#48

Post by brenton07 »

herbst wrote: post #37
pilif wrote: post #35

Earlier quoted context omitted.

Whenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it. And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory som…

i dont even know which version i run, so no idea if i have to be scared or not. updates are way to painful to do regulary on a working dev machine. (lazy linux user here) anyway i never saved a password, thats exactly my point. There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.

Yeah, there's no great answer here other than its an area that requires innovation. Apple is usually pretty good in this area, and I'd love to see them bring something to the table. My hope in writing the article was to spur enough debate and attention around the subject that it might foster that innovation conversation.

I think by digging through the comments on the multiple portals this was posted since I went to bed last night that at the least, people have strong opinions on both sides. It's either security or convenience, but it's certainly presented on the surface that its both. The point of the article was it is not.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#50

Post by rangibaby »

brenton07 wrote: post #47
rangibaby wrote: post #26

Earlier quoted context omitted.

The new security was added in 10.11 afaik

Wonder if it got bumped on accident on a recent update. My system has been modified to allow system access, so its less surprising (although still a flaw). But we did it on machines by people that are probably TOTALLY unaware of those 10.11 changes and wouldn't have the know how to modify something like that, and it still worked on their machines.

They might have turned it down or off because it was buggy.

Trying to get a password out of my keychain using Screen Sharing completely hosed it (10.11 initial release). Even opening Keychain Access resulted in an instant freeze and spinning wheel. I ended up having to completely recreate my keychain and reset a lot of passwords.

Post reply on HN