Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

Post reply on HN
Print view View original

41–50 of 94 posts

Re: OSX password script for everyone to know

#41

Post by rapind »

evoxed wrote: post #35
sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

On that note, it actually seems like a pretty good place for Apple to sweep in and take some thunder from 1Password et al, by sprucing up the Keychain app and making it something that everyone can sort of use without thinking about it. Just throw around talk of 'sandboxing' and 'secure access', turn it on by default, profit. Then if (by default) you needed an Apple device and iCloud account to login to all your shit.…

Please God no. I've been waiting about a month now to re-access an iCloud account as Apple sorts out their security issues.

Re: OSX password script for everyone to know

#42

Post by Bakkot »

jdechko wrote: post #10
brockrockman wrote: post #4

Hardly a security flaw. How do you expect Safari/Chrome autofill the same passwords? And after the password is auto-filled any JavaScript can access the input's value attribute. I use this in my .emacs so Emacs can grab passwords from Keychain, but the same approach would work in bash too: (defun find-keychain-password (host) () (condition-case nil (let ((passstr (second (split-string (first (process-lines "/usr/bin/…

I'm inclined to agree. It looks like this is the same "hack" detailed last week, though through a terminal command instead of an application. As we learned last week, by default, OS X is set to never lock the keychain once it is logged in. It's a conscious choice of default set by Apple. If you care about tighter security, just change the autolock time or use separate keychains.

No, last week's was root only, operated by searching through RAM for various keys, and was notable for displaying passwords for every logged-in user, which this will not do.

Re: OSX password script for everyone to know

#43

Post by jasomill »

aidos wrote: post #21

The reason this is strange behaviour is that when you try to access private info from within keychain you have to enter your user password each time. Using this command you just need to click on the allow button. The keychain only allows applications that you authorize to access a given password, right? So for example, when I upgrade Transmit, it needs to ask for my permission to access the passwords again. Does that…

Perhaps, but the Transmit developers could actually even use code signing to get Keychain to recognize multiple versions (new ones, but also alternative builds such as might be distributed by the Mac App Store) as the "same" application (Google "designated requirements"). Either way, though, barring security bugs (including unnecessarily permissive designated requirements being used by other apps), this should only give Transmit access to passwords you've specifically authorized for Transmit. Of course, if Transmit were malicious and one of these passwords happened to be your local login password...

Re: OSX password script for everyone to know

#47

Post by DanBC »

Karunamon wrote: post #8
mcrider wrote: post #6

Earlier quoted context omitted.

You don't need a password to press 'allow'. It is still very much a security concern.

Why is someone who is not you logged in using your account with the ability to click that button in the first place? Layering security on the user account after login tends to annoy the hell out of people. Ask any users you know what they think of Windows 7/Vista's UAC.

I agree with your first sentence. I sort of agree with the people saying this behaviour is by design and is not a serious security flaw.

> Layering security on the user account after login tends to annoy the hell out of people. Ask any users you know what they think of Windows 7/Vista's UAC.

But this isn't another OS. This is OS X, which is built on BSD, and BSD is a secure OS. Another question to ask would be "Ask any users you know what they think of sudo".

I like the article. It's not sensationalist. It's not dramatic. It's just saying "Hey, do this! Surprised? This is why you need to be careful with your account and your password."

That seems reasonable to me. Many people Using OS X are not from a Unix background. They have never used a BSD before. They don't really have the security stuff ingrained.

Gentle reminders from time to time are a good thing.

Re: OSX password script for everyone to know

#48

Post by wamatt »

mjhall wrote: post #13
mcrider wrote: post #6

Earlier quoted context omitted.

You don't need a password to press 'allow'. It is still very much a security concern.

To add to grecy's comment: Your login Keychain is usually unlocked - it's encrypted with a key derived from your password that's held in memory from when you log in. You can lock your login Keychain (or any other) from Keychain Acccess (/Applications/Utilities) or from the security menu bar item (if you have it added) and you'll be asked for the password rather than asked to "allow" it.

Ahh ok, subtle distinction. Thanks for clearing that up. :)

Re: OSX password script for everyone to know

#49

Post by tlrobinson »

jtokoph wrote: post #17

You may want to setup autolocking: 1. Launch "Keychain Access". 2. Right click on "login" keychain. 3. Click "Change Settings for Keychain 'login'". 4. Check the "Lock after:" box. 5. Change the minutes of activity to whatever you want. You have the option of auto-locking after zero minutes of inactivity.

I tried this, and quickly got annoyed with having to enter my password every time iCal tried to sync.

It would be better if you could set it to require a password every time a previously unauthorized app requests access to a Keychain item.

Re: OSX password script for everyone to know

#50

Post by dkokelley »

FlukeATX wrote: post #37
dkokelley wrote: post #31

First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest sessi…

What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?

shadowflit made a good point about two-factor authentication. I would also add that by having cookies (and hence a presumed established session with you bank, email provider, or social network) you bypass one of the steps to get what you presumably want: access. I mean to point out that there is no reason to run this script if you already have physical access to a computer with the target's account logged on. You already have the extra access you need.
Post reply on HN