4 ms·

Um, OK. Or you could just go to Preferences > Security > Saved Passwords (Firefox), or fire up Keychain Access (for Safari/Mac), or ... ?

• joejohnson 15y ago
  Yes. This is a big vulnerability on Mac. If someone knows your password (say, to let them in in case of a screensaver when you're not there...) then they can view any saved passwords in Keychain Access with this same password. I know a lot of people who don't realize this.
  • jonknee 15y ago
    That's a feature, not a bug. I use it all the time. It's a password manager, as the admin I should be able to view its data.
    • peterwwillis 15y ago
      None of my linux keychain passwords are the same as my user password. The keychain password is much more difficult and I never re-enter it to get back into my machine (unlike the screensaver password prompt).
      • jonknee 15y ago
        You can change your Keychain's password... "Edit > Change password for Keychain "login"..."
        • peterwwillis 15y ago
          when i said 'my linux keychains' i meant ssh-agent and firefox's password repository. neither can have their passwords changed without putting in the password again; the credentials are merely stored in memory. (so if you could get past the screensaver you could in theory extract the creds from memory, but i don't know of a tool to do this and doing it by hand could be time consuming)
          • jonknee 15y ago
            Sure, but I was speaking of OS X. Your Keychain password doesn't have to be the same as your account password.
            • peterwwillis 15y ago
              Oh, I misunderstood; I thought you meant anyone could change the keychain password once they logged into the box (which would be kind of dangerous)
  • Uchikoma 15y ago
    Security breaks there already: If someone knows your password ...
    • danparsonson 15y ago
      ... that doesn't mean they should automatically get to know all your other passwords. When I'm making online bank transfers, I get prompted for my password for every transfer, even though I'm already logged in - better to double-check the really sensitive stuff, rather than just protect the entry point.
      • blackRust 15y ago
        And under OS X you can change your keychain password (independently of login), though yes, you have to do it manually and it isin't "secure" by default.
  • riobard 15y ago
    You can create additional different keychains with different passwords than the login one. For most people, having a password manager + random-generated passwords are _much_ better than using one simple password for all.
  • gmac 15y ago
    Even more so on Firefox, whatever the platform -- the password store isn't even password-protected by default.