As others have alluded to, this is the "Login" keychain--a keychain of usernames and passwords that are unlocked upon a user's login. This is by design, not a security flaw.
Security Flaw in OS X displays all keychain passwords in plain text
21–30 of 57 posts
Re: Security Flaw in OS X displays all keychain passwords in plain text
#22This is bogus.
If you execute "security dump-keychain -d login.keychain":
1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured.
2. If the keychain is locked (for example, by clicking the padlock in the Keychain Access app to lock it), it asks you for your user password, just like the Keychain Access app does.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#23This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…
Oh yes we should definitely give apple a free pass on this one too, because it destroys our rapidly fading narrative that OSX is somehow more secure. But we all know that if Windows did the same thing, "cocotino" (name tells you all you need to know) and his herd of drones would trumpet it with glee yet again.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#24This is actually really useful - thank you. I have been looking for an easy way to search for re-use of compromised passwords.
Re: Security Flaw in OS X displays all keychain passwords in plain text
#25tell process "SecurityAgent" click button "Allow" of group 1 of window 1 I'm pretty certain this is not possible in any recent version of OS X.
I get: "System Events got an error: Can’t get group 1 of window 1 of process "SecurityAgent". Invalid index."
Re: Security Flaw in OS X displays all keychain passwords in plain text
#26Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.
On 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.
The new security was added in 10.11 afaik
Re: Security Flaw in OS X displays all keychain passwords in plain text
#27"working as intended"
Re: Security Flaw in OS X displays all keychain passwords in plain text
#28Exactly why i don't trust my mac with my passwords.
how do you login
Re: Security Flaw in OS X displays all keychain passwords in plain text
#29Exactly why i don't trust my mac with my passwords.
how do you login
It's a huge difference to use system specific passwords on that specific system or to trust a properitary buggy system with passwords to other, potentially critical, services and infrastructure.
Which IMO is purely negligently
Re: Security Flaw in OS X displays all keychain passwords in plain text
#30This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keyc…
I just replicated this and it is true for 10.11.5