Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

Post reply on HN
Print view View original

51–60 of 94 posts

Re: OSX password script for everyone to know

#51

Post by evoxed »

rapind wrote: post #41
evoxed wrote: post #35

Earlier quoted context omitted.

On that note, it actually seems like a pretty good place for Apple to sweep in and take some thunder from 1Password et al, by sprucing up the Keychain app and making it something that everyone can sort of use without thinking about it. Just throw around talk of 'sandboxing' and 'secure access', turn it on by default, profit. Then if (by default) you needed an Apple device and iCloud account to login to all your shit.…

Please God no. I've been waiting about a month now to re-access an iCloud account as Apple sorts out their security issues.

Well I don't necessarily think it's a good thing... but it seems like just the sort of opportunity awaiting them (and their lawyers, when the antitrust suits eventually come).

Re: OSX password script for everyone to know

#52

Post by javajosh »

While it is shocking to see your passwords scroll by in plaintext, a careful consideration of how to fix the problem, one realizes that the offered solution really isn't good enough. Many applications require your passwords in order to run, and the Keychain is the way OSX apps get those passwords.

After a little thought, there are two solutions. First, and best, is to log out, and let your guest use a guest account. Or second, watch over the persons shoulder (which is probably a good idea anyway for the security conscious.)

But, personally my biggest concern is that it highlights how trivial it is for locally installed software to access my other passwords! It means that all of my passwords are only as protected as my least-trusted local app. And I have to say, my least trusted app is pretty untrusted. The only saving grace is that OSX asks me if I want to allow an app to access that password.

Re: OSX password script for everyone to know

#53

Post by droithomme »

Keychain Access and the general security model is poor.

There should be a way for web passwords that are saved from a browser to be restricted for use from a set of authorized browsers only, without also allowing any random program from just grabbing the plaintext.

From what I observe using this system, once you lock the entire keychain, then you have to unlock and relock it everytime you use a web password, or if you forget to relock, after authorizing one time access from the browser popup, it unlocks the whole keychain for the entire system. Unlocking my throwaway yahoo junk mail account in Safari should not also unlock the password to my banking account across the whole system.

This is not the best design and those who say "works as designed", in my opinion, are suffering from myopic tunnel vision where they assume a current design is the only possible design.

Re: OSX password script for everyone to know

#54

Post by [deleted] »

macchina wrote: post #38
sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill. *Edit: Actually it looks like you can set Keychain to lock automaticall…

[deleted]

Re: OSX password script for everyone to know

#55

Post by zx2c4 »

javajosh wrote: post #52

While it is shocking to see your passwords scroll by in plaintext, a careful consideration of how to fix the problem, one realizes that the offered solution really isn't good enough. Many applications require your passwords in order to run, and the Keychain is the way OSX apps get those passwords. After a little thought, there are two solutions. First, and best, is to log out, and let your guest use a guest account.…

Alternatively, it might be worthwhile to switch from using Keychain to using pass, a far better and simpler alternative: http://zx2c4.com/projects/password-store

Re: OSX password script for everyone to know

#56

Post by javajosh »

zx2c4 wrote: post #55
javajosh wrote: post #52

While it is shocking to see your passwords scroll by in plaintext, a careful consideration of how to fix the problem, one realizes that the offered solution really isn't good enough. Many applications require your passwords in order to run, and the Keychain is the way OSX apps get those passwords. After a little thought, there are two solutions. First, and best, is to log out, and let your guest use a guest account.…

Alternatively, it might be worthwhile to switch from using Keychain to using pass, a far better and simpler alternative: http://zx2c4.com/projects/password-store

it appears that this is self-promotion, but that's a nice-looking tool. it does look a little disruptive to my workflow (I suggest doing a screencast demonstrating some real world scenarios like periodically checking ical or gmail). and also, unique, not widely used (and not widely audited) security software seems like taking a pretty big risk. not really sure what you can do about that, since it's kind of a chicken and egg problem. but open sourcing it would help get the ball rolling.

Re: OSX password script for everyone to know

#57

Post by draebek »

tlrobinson wrote: post #49
jtokoph wrote: post #17

You may want to setup autolocking: 1. Launch "Keychain Access". 2. Right click on "login" keychain. 3. Click "Change Settings for Keychain 'login'". 4. Check the "Lock after:" box. 5. Change the minutes of activity to whatever you want. You have the option of auto-locking after zero minutes of inactivity.

I tried this, and quickly got annoyed with having to enter my password every time iCal tried to sync. It would be better if you could set it to require a password every time a previously unauthorized app requests access to a Keychain item.

I think I had this same problem with Mail.app. I "solved" it by creating a separate keychain that just locks on sleep, but doesn't timeout, and moving my Mail passwords into that keychain. Presumably the same thing would work for iCal.

Re: OSX password script for everyone to know

#59

Post by dustingetz »

ghayes wrote: post #34
sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I guess a bigger question is why don't we use challenge/response authentication for websites? This way, a program like keychain could answer challenges without ever exposing plain-text passwords.

Am I the only one who read your post and said "huh"? Don't mean to have a naive reply, but this is new to me.

Re: OSX password script for everyone to know

#60

Post by tomwalsham »

A nice visible reason why the Rails/Node/OSX FOSS community really need to stop doing the following sort of thing for their installations (seen most recently on yeoman.io, but common to get.pow.cx, npm...)::

curl get.totallytrustworthyapp.io | bash

The above examples are obviously legit, but encouraging this kind of lazy access to even local privileges from arbitrary remote scripts (and Yeoman even asks for sudo in a super-friendly way), is the modern equivalent of padlock.gif on your payment page - training poor security practices.

Post reply on HN