Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

31–40 of 94 posts

Re: OSX password script for everyone to know

#31
First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest session to access my keychain.

Knowing this, I will rewrite the opening line to the article.

Original line: "Here’s a reason why you shouldn’t let anyone use your computer."

My revised line: "Here's a reason why you shouldn't let [untrusted persons] use [a non-guest session on] your computer."

Re: OSX password script for everyone to know

#32
Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that your web passwords are not safe.

However, Keychain Access is perfectly secure as a dead-simple manual password manager. Just create a new keychain (I call mine "webpasses"), give it a password different than your login password, and manually save your web passwords in that. Yes you have to open Keychain Access every time you want to save (or copy the plaintext of) a password. Yes it's a bitch. But if you save your passwords in the correct format (description=website URL, username=website username) then Chrome and Safari will find it, ask for your "webpasses" keychain password, and autofill, no questions asked. Bonus points because you can save your new keychain in your dropbox and use it across multiple (osx) machines. I store all my credit card numbers in one keychain file, everything is AES encrypted IIRC so it's as good a solution as any as far as "one-password-auth" goes.

[/rant]

(note: I chose this solution because I am paranoid -- er, security conscious. The average user will NOT want to enter a password anytime he/she wants to autofill, and there's really no way to do this in a secure manner)

EDIT: grammar

Re: OSX password script for everyone to know

#33
post #17

You may want to setup autolocking: 1. Launch "Keychain Access". 2. Right click on "login" keychain. 3. Click "Change Settings for Keychain 'login'". 4. Check the "Lock after:" box. 5. Change the minutes of activity to whatever you want. You have the option of auto-locking after zero minutes of inactivity.

or using command line (lock default keychain on sleep and after 30 min):

  $ security set-keychain-settings -lut 1800

Re: OSX password script for everyone to know

#34

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I guess a bigger question is why don't we use challenge/response authentication for websites? This way, a program like keychain could answer challenges without ever exposing plain-text passwords.

Re: OSX password script for everyone to know

#35

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

On that note, it actually seems like a pretty good place for Apple to sweep in and take some thunder from 1Password et al, by sprucing up the Keychain app and making it something that everyone can sort of use without thinking about it. Just throw around talk of 'sandboxing' and 'secure access', turn it on by default, profit. Then if (by default) you needed an Apple device and iCloud account to login to all your shit... I think you see where this is going.

Re: OSX password script for everyone to know

#36

Is 1Password more or less secure than Keychain? If my 1Password is unlocked can any application get passwords out of it?

That's an interesting question. 1Password isn't as integrated as the Keychain, but in both cases you have to manually approve access. 1Password is more portable though - Keychain is only useful in MacOS X.

Keychain uses AES256 so it's about as reasonably secure of a single-password solution as you can get (given you use it correctly). I would assume 1Password is equivalently secure.

Re: OSX password script for everyone to know

#37

First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest sessi…

What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?

Re: OSX password script for everyone to know

#38

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill.

*Edit: Actually it looks like you can set Keychain to lock automatically after X minutes of inactivity or when the computer sleeps.

Re: OSX password script for everyone to know

#39

Earlier quoted context omitted.

That's an interesting question. 1Password isn't as integrated as the Keychain, but in both cases you have to manually approve access. 1Password is more portable though - Keychain is only useful in MacOS X.

Keychain uses AES256 so it's about as reasonably secure of a single-password solution as you can get (given you use it correctly). I would assume 1Password is equivalently secure.

I'm less worried about the crypto algorithms used than what's available decrypted and when.

Re: OSX password script for everyone to know

#40

First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest sessi…

What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?

If you have two factor authentication but leave yourself signed in, a password alone will not get an intruder into your account, but a cookie will.
Post reply on HN