4 ms·
Isn't this how keychain works? This is clearly not remotely executable, it needs to be run on the device that is signed in. Say you visit facebook.com, your p
by altitudinous 9y ago
Isn't this how keychain works?
This is clearly not remotely executable, it needs to be run on the device that is signed in.
Say you visit facebook.com, your password is in the keychain, so the keychain must be decrypted to return the plaintext password so it can be passed in the password field to facebook.com
This is how keychain works isn't it??
You can view your entire password list in Safari Preferences - it does the same thing.
So this is nothing? Someone has written a command line version of this same tool.
Am I missing something, this seems to be normal functionality of the OS for a signed in user.
- teilo 9y agoNo. Application access to the keychain is restricted via an API with a (supposedly) robust security model behind it, for precisely this reason. Applications must explicitly be granted access to the keychain. There should have been a prompt requesting keychain access.
- mikeash 9y agoFurthermore, it's supposed to ask about each item the app wants to access. You can see this in Keychain Access. Pick a password, inspect it, click the Show Password box, and a prompt will appear asking you to authorize it before it'll show you anything. That's part of the Keychain API, not something special to Keychain Access.
- lloeki 9y agoAlso visible with the built-in CLI tool security(1): $ security find-internet-password -s www.facebook.com -g
- thoughtsimple 9y agoDidn't work for me on today's release of macOS High Sierra.
- teilo 9y agoWorks for me on HS.