Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

Post reply on HN
Print view View original

21–30 of 94 posts

Re: OSX password script for everyone to know

#21

Post by aidos »

The reason this is strange behaviour is that when you try to access private info from within keychain you have to enter your user password each time. Using this command you just need to click on the allow button.

The keychain only allows applications that you authorize to access a given password, right? So for example, when I upgrade Transmit, it needs to ask for my permission to access the passwords again. Does that give it access to everything or just a specific password / set of passwords?

Re: OSX password script for everyone to know

#22

Post by aidos »

leejoramo wrote: post #19

I ran this command and for at least the first 10 items, I was prompted by a GUI dialog to allow the export of the keychain item. (I have close to 2,000 items in my keychain, so it is a small sample.) I think that this is more of a lesson to: 1) Have reason able auto locking time outs setup via the Keychain and Screen Saver 2) when Keychain Access prompts you to access info that you should normally click "Allow" and n…

But if you click in allow you could actually see the protected info, right? No password required.

Re: OSX password script for everyone to know

#25

Post by eddieplan9 »

lambda wrote: post #20
geofft wrote: post #11

Earlier quoted context omitted.

Why would it need sudo? If that were the case, then every web browser and every IM client and everything else on your computer with a password would need sudo. You're telling your computer to save your passwords and give them back to you later. You shouldn't be surprised when it gives them back to you later.

So, generally each application needs to be authorized separately. I should have to type my password to allow this application to access my passwords. If I can just click "allow" with no password, then so can anyone else trivially with Terminal access. If I go into Keychain access, and ask to see a password, it prompts for my master password before showing it to me. This should too.

From KeyChain's point of view, this command-line utility, /usr/bin/security, is no different from other GUI applications like Mail.app and Safari.app that relies on KeyChain to supply remembered passwords. If you expect KeyChain to prompt you for your master password when /usr/bin/security asks KeyChain for passwords, then you will be prompted every time Mail.app checks your email.

Actually you can configure KeyChain to do just that: just set the keychain to lock after 0 minutes of inactivity. But there is always the tradeoff between security and convenience. And when you give away physical access and a logged-in session away to a malicious user, offering protection will require a lot of inconvenience.

Re: OSX password script for everyone to know

#26

Post by sitharus »

aidos wrote: post #21

The reason this is strange behaviour is that when you try to access private info from within keychain you have to enter your user password each time. Using this command you just need to click on the allow button. The keychain only allows applications that you authorize to access a given password, right? So for example, when I upgrade Transmit, it needs to ask for my permission to access the passwords again. Does that…

An application can only read passwords you've specifically allowed it to. When you upgrade Transmit it only gets access to that subset.

If you're curious go to Keychain Access, double click an item and look at the Access Control tab. You can even force password entry there if you want extra security on certain items.

Re: OSX password script for everyone to know

#27

Post by sitharus »

brockrockman wrote: post #4

Hardly a security flaw. How do you expect Safari/Chrome autofill the same passwords? And after the password is auto-filled any JavaScript can access the input's value attribute. I use this in my .emacs so Emacs can grab passwords from Keychain, but the same approach would work in bash too: (defun find-keychain-password (host) () (condition-case nil (let ((passstr (second (split-string (first (process-lines "/usr/bin/…

That's a handy function! Thanks for sharing :)

Re: OSX password script for everyone to know

#29

Post by mkmk »

jtokoph wrote: post #17

You may want to setup autolocking: 1. Launch "Keychain Access". 2. Right click on "login" keychain. 3. Click "Change Settings for Keychain 'login'". 4. Check the "Lock after:" box. 5. Change the minutes of activity to whatever you want. You have the option of auto-locking after zero minutes of inactivity.

Just in case anybody else doesn't see the 'login' keychain: the square button with a triangle in the bottom left corner shows and hides an additional list of keychains

Re: OSX password script for everyone to know

#30

Post by sitharus »

tlrobinson wrote: post #28

Is 1Password more or less secure than Keychain? If my 1Password is unlocked can any application get passwords out of it?

That's an interesting question. 1Password isn't as integrated as the Keychain, but in both cases you have to manually approve access.

1Password is more portable though - Keychain is only useful in MacOS X.

Post reply on HN