Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

Post reply on HN
Print view View original

11–20 of 94 posts

Re: OSX password script for everyone to know

#11

Post by geofft »

paupino_masano wrote: post #2

Admittedly I was a bit shocked to see my passwords start pumping out: all I needed to do was click "Allow" and away it went. Why would keychain remain unlocked? Why doesn't that command need sudo? This seems like a pretty decent security flaw to me...

Why would it need sudo? If that were the case, then every web browser and every IM client and everything else on your computer with a password would need sudo.

You're telling your computer to save your passwords and give them back to you later. You shouldn't be surprised when it gives them back to you later.

Re: OSX password script for everyone to know

#12

Post by geofft »

stuartd wrote: post #7

I run as a non-admin user on Mountain Lion (stops the kids messing stuff up) and it sometimes has unexpected benefits - like in this case, when I run security dump-keychain -d ~/Library/Keychains/login.keychain in terminal the output is most definitely not plain text even after I press 'Allow' - see http://pastebin.com/TH63R9sM for a sample

Oh cool, is that your client certificate's private key?

Re: OSX password script for everyone to know

#13

Post by mjhall »

mcrider wrote: post #6
robmil wrote: post #5

Earlier quoted context omitted.

Is this sarcasm? You clicked "Allow"; what would you expect of an application to which you granted access to your keychain, other than for that application to thereby gain access to your keychain?

You don't need a password to press 'allow'. It is still very much a security concern.

To add to grecy's comment:

Your login Keychain is usually unlocked - it's encrypted with a key derived from your password that's held in memory from when you log in.

You can lock your login Keychain (or any other) from Keychain Acccess (/Applications/Utilities) or from the security menu bar item (if you have it added) and you'll be asked for the password rather than asked to "allow" it.

Re: OSX password script for everyone to know

#15

Post by kreek »

Locking the keychain works until you unlock it from another app. If you enter your keychain password for Mail app or for a web password it becomes unlocked for the terminal command. Which is unexpected behavior as from within keychain, even if it is unlocked, you must reenter your password if you want to see a saved password.

Re: OSX password script for everyone to know

#16

Post by eblume »

stuartd wrote: post #7

I run as a non-admin user on Mountain Lion (stops the kids messing stuff up) and it sometimes has unexpected benefits - like in this case, when I run security dump-keychain -d ~/Library/Keychains/login.keychain in terminal the output is most definitely not plain text even after I press 'Allow' - see http://pastebin.com/TH63R9sM for a sample

You should probably delete that, I'm thinking that that's a private key. It's not a 'password' but it's still a secret, and you just pastebin'ed it for everyone.

But I'm just guessing -- I don't know too well what a private key would look like in this format.

Re: OSX password script for everyone to know

#17

Post by jtokoph »

You may want to setup autolocking:

1. Launch "Keychain Access".

2. Right click on "login" keychain.

3. Click "Change Settings for Keychain 'login'".

4. Check the "Lock after:" box.

5. Change the minutes of activity to whatever you want.

You have the option of auto-locking after zero minutes of inactivity.

Re: OSX password script for everyone to know

#18

Post by eblume »

jtokoph wrote: post #17

You may want to setup autolocking: 1. Launch "Keychain Access". 2. Right click on "login" keychain. 3. Click "Change Settings for Keychain 'login'". 4. Check the "Lock after:" box. 5. Change the minutes of activity to whatever you want. You have the option of auto-locking after zero minutes of inactivity.

I was about 5 minutes in to the docs to set up a quicksilver task to do this - thanks for helping me avoid re-inventing the wheel. Yours was the better 'hack'. ;)

Re: OSX password script for everyone to know

#19

Post by leejoramo »

I ran this command and for at least the first 10 items, I was prompted by a GUI dialog to allow the export of the keychain item. (I have close to 2,000 items in my keychain, so it is a small sample.)

I think that this is more of a lesson to:

1) Have reason able auto locking time outs setup via the Keychain and Screen Saver

2) when Keychain Access prompts you to access info that you should normally click "Allow" and not "Always Allow".

Re: OSX password script for everyone to know

#20

Post by lambda »

geofft wrote: post #11
paupino_masano wrote: post #2

Admittedly I was a bit shocked to see my passwords start pumping out: all I needed to do was click "Allow" and away it went. Why would keychain remain unlocked? Why doesn't that command need sudo? This seems like a pretty decent security flaw to me...

Why would it need sudo? If that were the case, then every web browser and every IM client and everything else on your computer with a password would need sudo. You're telling your computer to save your passwords and give them back to you later. You shouldn't be surprised when it gives them back to you later.

So, generally each application needs to be authorized separately. I should have to type my password to allow this application to access my passwords. If I can just click "allow" with no password, then so can anyone else trivially with Terminal access.

If I go into Keychain access, and ask to see a password, it prompts for my master password before showing it to me. This should too.

Post reply on HN