3 ms·

That only allows exporting the passwords of the currently logged-in user. If you let someone untrusted (!) log in remotely to your computer with your user acco

That only allows exporting the passwords of the currently logged-in user. If you let someone untrusted (!) log in remotely to your computer with your user account or you give it to someone while your user is logged in it's your own fault if your keys get stolen. You should use a guest account with restricted privileges or a separate machine. It's not much different on Linux, if you use Gnome-Keyring (used by default in Ubuntu and others) you can also get the passwords easily, in plain text [1]. Not sure about Windows, but you can most likely get to the passwords without installing anything as well if you're already logged in as the current user. If you're allowed to run executables, there are quite a few already [2]. [1] https://blog.schmichael.com/2008/10/30/listing-all-passwords-stored-in-gnome-keyring/ https://blog.schmichael.com/2008/10/30/listing-all-passwords... [2] http://www.nirsoft.net/password_recovery_tools.html http://www.nirsoft.net/password_recovery_tools.html

gilgoomesh 10y ago
Simply being logged in is not sufficient. The only way this should be possible on the Mac is if a logged in user physically at the computer selects "Allow" or "Always allow" for each security dialog that appears. Remote sessions are not permitted to do this. Security dialogs cannot be scripted under normal circumstances (the AppleScript given in the article simply doesn't work). I suspect it might be possible to do highly dangerous things like blessing the "System Events" tool as an Accessibility tool in the Security System Prefs Pane (which would allow it to send events to security dialogs) but I'm not totally sure that's possible and in any case, I don't think that's happening here. I think the author is simply mistaken or has clicked "Always allow" in the past and doesn't realize that this setting is still active.
- brenton07 10y ago
  I was actually the author of this article, and am about to update it to address some of the criticisms. We have two machines locked down to only certain functions, down to only certain IP addresses even being allowed to communicate with the machines, and still managed to execute this - it did prompt Allow/Deny windows, but I find that intellectually different than a lack of password prompt. I have dug through security preferences extensively and can't see what setting could be changed or updated to disallow this function. I've updated the article to address and respond to some of the criticisms and feedback.

gilgoomesh 10y ago

Simply being logged in is not sufficient. The only way this should be possible on the Mac is if a logged in user physically at the computer selects "Allow" or "Always allow" for each security dialog that appears. Remote sessions are not permitted to do this. Security dialogs cannot be scripted under normal circumstances (the AppleScript given in the article simply doesn't work). I suspect it might be possible to do highly dangerous things like blessing the "System Events" tool as an Accessibility tool in the Security System Prefs Pane (which would allow it to send events to security dialogs) but I'm not totally sure that's possible and in any case, I don't think that's happening here. I think the author is simply mistaken or has clicked "Always allow" in the past and doesn't realize that this setting is still active.

brenton07 10y ago
I was actually the author of this article, and am about to update it to address some of the criticisms. We have two machines locked down to only certain functions, down to only certain IP addresses even being allowed to communicate with the machines, and still managed to execute this - it did prompt Allow/Deny windows, but I find that intellectually different than a lack of password prompt. I have dug through security preferences extensively and can't see what setting could be changed or updated to disallow this function. I've updated the article to address and respond to some of the criticisms and feedback.