OSX password script for everyone to know

Post by klodolph » Fri, Sep 14, 2012, 9:44 AM UTC

shadowflit wrote: post #40

FlukeATX wrote: post #37

Earlier quoted context omitted.

What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?

If you have two factor authentication but leave yourself signed in, a password alone will not get an intruder into your account, but a cookie will.

Post by klodolph » Fri, Sep 14, 2012, 10:05 AM UTC

sil3ntmac wrote: post #36

sitharus wrote: post #30

Earlier quoted context omitted.

That's an interesting question. 1Password isn't as integrated as the Keychain, but in both cases you have to manually approve access. 1Password is more portable though - Keychain is only useful in MacOS X.

Keychain uses AES256 so it's about as reasonably secure of a single-password solution as you can get (given you use it correctly). I would assume 1Password is equivalently secure.

Post by zx2c4 » Fri, Sep 14, 2012, 11:21 AM UTC

javajosh wrote: post #56

zx2c4 wrote: post #55

Earlier quoted context omitted.

Alternatively, it might be worthwhile to switch from using Keychain to using pass, a far better and simpler alternative: http://zx2c4.com/projects/password-store

it appears that this is self-promotion, but that's a nice-looking tool. it does look a little disruptive to my workflow (I suggest doing a screencast demonstrating some real world scenarios like periodically checking ical or gmail). and also, unique, not widely used (and not widely audited) security software seems like taking a pretty big risk. not really sure what you can do about that, since it's kind of a chicken…

Post by Someone » Fri, Sep 14, 2012, 1:23 PM UTC

tjoff wrote: post #74

izakage wrote: post #69

Earlier quoted context omitted.

I was simply trying to clarify the challenge-response mechanism for the parent poster, not suggesting you use keychain dongles everywhere. Regardless, the idea that the plaintext password doesn't have to leave the device (whether the device is a dongle, your phone, or the keychain application) is a valuable consequence of the challenge-response mechanism, and I wish support for it were more widespread.

The reason for why it isn't widespread is because you also have to spread it across all your devices. Which is neither secure nor usable enough for the mainstream today. Unless that is solved it isn't a solution worth considering.

  - computer shows challenge#

  - user types challenge# on bank supplied device

  - bank supplied device shows response

  - user types response on computer

Post by sil3ntmac » Fri, Sep 14, 2012, 2:23 PM UTC

macchina wrote: post #38

sil3ntmac wrote: post #32

Ugh, the people I work with (I work for a security firm) consider this a "hack" as well. This is expected behavior! How do you expect your passwords to autofill across browsers? It is called the login keychain for a reason. If someone has access to your user account, and your user account has associated web passwords that can be summoned without re-entering your login password, then the logical conclusion is that you…

I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill. *Edit: Actually it looks like you can set Keychain to lock automaticall…