4 ms·
If your passwords are going to be available to user mode processes without a privileged interactive password prompt, they're going to be available. This is how
by timdierks 10y ago
If your passwords are going to be available to user mode processes without a privileged interactive password prompt, they're going to be available. This is how it's designed and is necessary for the current user experience (that apps you are running have access to your key chain secrets for unlocked key chains).
Crippling tools to make it look like the passwords are hidden or further secured is just security theater.
- elsurudo 10y agoNo, there is an easy fix. Make the "SecurityAgent" process "special" and non-scriptable. Kind of how when Windows is requesting a permission, the whole screen is otherwise grayed out with an overlay. It should run in some sort of permission mode where only direct, physical user input is taken into account (unless the user has previously selected "always allow" for this application).