OSX password script for everyone to know
blog.songz.me
OSX password script for everyone to know
1–10 of 94 posts
Re: OSX password script for everyone to know
#2Admittedly I was a bit shocked to see my passwords start pumping out: all I needed to do was click "Allow" and away it went. Why would keychain remain unlocked? Why doesn't that command need sudo? This seems like a pretty decent security flaw to me...
Re: OSX password script for everyone to know
#3I'm totally going to use this for way more bad than good.
Re: OSX password script for everyone to know
#4Hardly a security flaw. How do you expect Safari/Chrome autofill the same passwords? And after the password is auto-filled any JavaScript can access the input's value attribute.
I use this in my .emacs so Emacs can grab passwords from Keychain, but the same approach would work in bash too: (defun find-keychain-password (host) () (condition-case nil (let ((passstr (second (split-string (first (process-lines "/usr/bin/security" "find-internet-password" "-gs" host)) ": ")))) (substring passstr 1 (1- (length passstr)))) (error nil)))
Re: OSX password script for everyone to know
#5Admittedly I was a bit shocked to see my passwords start pumping out: all I needed to do was click "Allow" and away it went. Why would keychain remain unlocked? Why doesn't that command need sudo? This seems like a pretty decent security flaw to me...
Is this sarcasm? You clicked "Allow"; what would you expect of an application to which you granted access to your keychain, other than for that application to thereby gain access to your keychain?
Re: OSX password script for everyone to know
#6Admittedly I was a bit shocked to see my passwords start pumping out: all I needed to do was click "Allow" and away it went. Why would keychain remain unlocked? Why doesn't that command need sudo? This seems like a pretty decent security flaw to me...
Is this sarcasm? You clicked "Allow"; what would you expect of an application to which you granted access to your keychain, other than for that application to thereby gain access to your keychain?
You don't need a password to press 'allow'. It is still very much a security concern.
Re: OSX password script for everyone to know
#7I run as a non-admin user on Mountain Lion (stops the kids messing stuff up) and it sometimes has unexpected benefits - like in this case, when I run security dump-keychain -d ~/Library/Keychains/login.keychain in terminal the output is most definitely not plain text even after I press 'Allow' - see http://pastebin.com/TH63R9sM for a sample
Re: OSX password script for everyone to know
#8Earlier quoted context omitted.
Is this sarcasm? You clicked "Allow"; what would you expect of an application to which you granted access to your keychain, other than for that application to thereby gain access to your keychain?
You don't need a password to press 'allow'. It is still very much a security concern.
Why is someone who is not you logged in using your account with the ability to click that button in the first place?
Layering security on the user account after login tends to annoy the hell out of people. Ask any users you know what they think of Windows 7/Vista's UAC.
Re: OSX password script for everyone to know
#9Earlier quoted context omitted.
Is this sarcasm? You clicked "Allow"; what would you expect of an application to which you granted access to your keychain, other than for that application to thereby gain access to your keychain?
You don't need a password to press 'allow'. It is still very much a security concern.
You need a password to be able to press allow.
Re: OSX password script for everyone to know
#10Hardly a security flaw. How do you expect Safari/Chrome autofill the same passwords? And after the password is auto-filled any JavaScript can access the input's value attribute. I use this in my .emacs so Emacs can grab passwords from Keychain, but the same approach would work in bash too: (defun find-keychain-password (host) () (condition-case nil (let ((passstr (second (split-string (first (process-lines "/usr/bin/…
I'm inclined to agree. It looks like this is the same "hack" detailed last week, though through a terminal command instead of an application. As we learned last week, by default, OS X is set to never lock the keychain once it is logged in. It's a conscious choice of default set by Apple. If you care about tighter security, just change the autolock time or use separate keychains.