Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OSX password script for everyone to know

blog.songz.me

Post reply on HN
Print view View original

61–70 of 94 posts

Re: OSX password script for everyone to know

#61

Post by blake8086 »

tomwalsham wrote: post #60

A nice visible reason why the Rails/Node/OSX FOSS community really need to stop doing the following sort of thing for their installations (seen most recently on yeoman.io, but common to get.pow.cx, npm...):: curl get.totallytrustworthyapp.io | bash The above examples are obviously legit, but encouraging this kind of lazy access to even local privileges from arbitrary remote scripts (and Yeoman even asks for sudo in a…

You're still ultimately going to be running some code without reading all of it first, aren't you?

Re: OSX password script for everyone to know

#62

Post by muyuu »

In Firefox and Chrome you can see all web passwords in plain text. It used to be the same in Safari but apparently not anymore. And that's when they don't leave their webmail logged in, which a lot of people do and they lend you their computer like nothing happened. This is often a master key to somebody's privacy, usually more critical than the kind of stuff have in their keychain most often (WLAN passwords and the like).

People around me are not the most security conscious, or they just know they can trust me.

I guess there's also the cultural bias to allow people "check their email" and stuff like that.

My keychain is always locked, I don't save sensitive web passwords in browsers, and I still don't let people use my computer unsupervised.

Re: OSX password script for everyone to know

#63

Post by kristopher »

Apple provides an easy way to lock your desktop when you go for coffee. To set it up:

  1. Launch "Keychain Access".
  2. Open Preferences from the "Keychain Access" menu
  3. Check the option labeled "Show keychain status in menu bar"
  4. (optional) While holding the cmd-key, click and drag the menu item over to the far right of the menu bar for easy access.
Enjoy!

Re: OSX password script for everyone to know

#64

Post by izakage »

dustingetz wrote: post #59
ghayes wrote: post #34

Earlier quoted context omitted.

I guess a bigger question is why don't we use challenge/response authentication for websites? This way, a program like keychain could answer challenges without ever exposing plain-text passwords.

Am I the only one who read your post and said "huh"? Don't mean to have a naive reply, but this is new to me.

The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since f is some type of hash function, we can assume that the client knew the actual password, as it would have been too hard computationally to come up with the correct response without it.

In such a scheme, the keychain can do the computation and the password never leaves the keychain. We can even go as far as to have the keychain be separate hardware (eg USB dongle), so the password never even has to exist on the client's computer at all.

Re: OSX password script for everyone to know

#65

Post by dave1010uk »

izakage wrote: post #64
dustingetz wrote: post #59

Earlier quoted context omitted.

Am I the only one who read your post and said "huh"? Don't mean to have a naive reply, but this is new to me.

The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since f is some type of hash function, we can assume that the client knew the actual password, as it would have been too hard computationally to come up with the correct response without it. In such a scheme…

I believe you are describing the HTML element.

https://developer.mozilla.org/en-US/docs/HTML/Element/keygen

Re: OSX password script for everyone to know

#67

Post by Tichy »

ghayes wrote: post #34
sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I guess a bigger question is why don't we use challenge/response authentication for websites? This way, a program like keychain could answer challenges without ever exposing plain-text passwords.

Still, somehow keychain would have to know the passwords, and presumably they would have to be encrypted with the login password of the current user. So it would still be possible for the current user to extract their own passwords. I don't think it is possible to hide passwords on the client side.

Re: OSX password script for everyone to know

#68

Post by tjoff »

izakage wrote: post #64
dustingetz wrote: post #59

Earlier quoted context omitted.

Am I the only one who read your post and said "huh"? Don't mean to have a naive reply, but this is new to me.

The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since f is some type of hash function, we can assume that the client knew the actual password, as it would have been too hard computationally to come up with the correct response without it. In such a scheme…

Okay, so my phone? My, at work, workstation?

How about borrowing a friends computer? If you suggest that I'd bring a USB-dongle for that we live in different universes.

Re: OSX password script for everyone to know

#69

Post by izakage »

tjoff wrote: post #68
izakage wrote: post #64

Earlier quoted context omitted.

The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since f is some type of hash function, we can assume that the client knew the actual password, as it would have been too hard computationally to come up with the correct response without it. In such a scheme…

Okay, so my phone? My, at work, workstation? How about borrowing a friends computer? If you suggest that I'd bring a USB-dongle for that we live in different universes.

I was simply trying to clarify the challenge-response mechanism for the parent poster, not suggesting you use keychain dongles everywhere.

Regardless, the idea that the plaintext password doesn't have to leave the device (whether the device is a dongle, your phone, or the keychain application) is a valuable consequence of the challenge-response mechanism, and I wish support for it were more widespread.

Re: OSX password script for everyone to know

#70

Post by klodolph »

macchina wrote: post #38
sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill. *Edit: Actually it looks like you can set Keychain to lock automaticall…

Better yet, open "Keychain Access", go to the preferences general tab, and click "Show keychain status in menu bar". Voilà, now you can lock and unlock keychains without switching applications. (This has been around for a long time, too.)
Post reply on HN