5 ms·

This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging i

This is bogus. If you execute "security dump-keychain -d login.keychain": 1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured. 2. If the keychain is locked (for example, by clicking the padlock in the Keychain Access app to lock it), it asks you for your user password, just like the Keychain Access app does.

TheWiseOne3 10y ago
Oh yes we should definitely give apple a free pass on this one too, because it destroys our rapidly fading narrative that OSX is somehow more secure. But we all know that if Windows did the same thing, "cocotino" (name tells you all you need to know) and his herd of drones would trumpet it with glee yet again.
merpnderp 10y ago
I just replicated this and it is true for 10.11.5
- deleted 10y ago
  [deleted]
- Karunamon 10y ago
  Replicated it succeeding, or failing? It isn't possible to script the security window; the scripting system can't even see it. http://prntscr.com/bqepwk http://prntscr.com/bqepwk
headShrinker 10y ago
Also, this ability to parse all the passwords unencrypted isn't a flaw and it isn't new. I ran this very command maybe 5 or 6 years also. Granted I was shocked to see all my passwords dump unhashed but you have to enter the users password and it makes sense that is the computer needs the passwords unhashed, there should be a secure command to gain access to them.
- yberreby 10y ago
  Hashing keychain passwords would make no sense. You hash passwords when you want to check against them. When you actually need to retrieve them at some point, however, you encrypt them.
eeeeeeeeeeeee 10y ago
Yep, just tested this myself and was immediately prompted for my password. No sensitive data was exposed if I simply clicked "deny."
- brenton07 10y ago
  We tested this on four machines and had no prompts for password authentication. Two of them are VERY close to clean installs with only Adobe CC and two or three other production software components installed, highest security settings for everything in preferences. We haven't been able to figure out why some users are prompted and others are not.

TheWiseOne3 10y ago

Oh yes we should definitely give apple a free pass on this one too, because it destroys our rapidly fading narrative that OSX is somehow more secure. But we all know that if Windows did the same thing, "cocotino" (name tells you all you need to know) and his herd of drones would trumpet it with glee yet again.

merpnderp 10y ago

I just replicated this and it is true for 10.11.5

deleted 10y ago
[deleted]
Karunamon 10y ago
Replicated it succeeding, or failing? It isn't possible to script the security window; the scripting system can't even see it. http://prntscr.com/bqepwk http://prntscr.com/bqepwk

headShrinker 10y ago

Also, this ability to parse all the passwords unencrypted isn't a flaw and it isn't new. I ran this very command maybe 5 or 6 years also. Granted I was shocked to see all my passwords dump unhashed but you have to enter the users password and it makes sense that is the computer needs the passwords unhashed, there should be a secure command to gain access to them.

yberreby 10y ago
Hashing keychain passwords would make no sense. You hash passwords when you want to check against them. When you actually need to retrieve them at some point, however, you encrypt them.

eeeeeeeeeeeee 10y ago

Yep, just tested this myself and was immediately prompted for my password. No sensitive data was exposed if I simply clicked "deny."

brenton07 10y ago
We tested this on four machines and had no prompts for password authentication. Two of them are VERY close to clean installs with only Adobe CC and two or three other production software components installed, highest security settings for everything in preferences. We haven't been able to figure out why some users are prompted and others are not.