3 ms·
Yes, you are completely missing how the keychain works. When you go to facebook.com, safari requests access to the facebook.com password via the keychain api.
by thefreeman 9y ago
Yes, you are completely missing how the keychain works.
When you go to facebook.com, safari requests access to the facebook.com password via the keychain api. At which point you are supposed to be prompted by the OS, and if you allow it, the keychain api returns the decrypted password only for facebook.com.
The vulnerability being demonstrated is able to decrypt every password in your keychain, without prompting the user in any way.
- eugeniub 9y agoWhen I go to Facebook.com, my login credentials are instantly filled in by Safari. What prompt are you talking about?
- jakobegger 9y agoYou either gave Safari permission before, or Safari was the app that added the password to the keychain in the first place.
- deleted 9y ago[deleted]