3 ms·

Safari's absolutely. It uses a OS-wide keychain secured via hardware.

• larschdk 2y ago
  Does this prevent other software running on the same hardware from accessing the keychain? E.g. on Windows, any program can access the entirety of the credential store for the current user.
  • bdash 2y ago
    Each keychain item on macOS has an access control list associated with it that lists the applications that are granted access to the keychain item. If an application not on the ACL attempts to access a keychain item, macOS prompts the user for authorization. The ACL entries identify applications based on properties of their code signature and so are not spoofable.
    • sureIy 2y ago
      Correct. The best part of this system (Keychain Access) is that it has been around for more than 20 years. Only this year it got a UX makeover. One interesting thing I noticed is that Chrome and Firefox can also seamlessly see and use Passkeys I stored in Safari even if normally they don't read the passwords from there. Using each passkey however still requires a fingerprint every time.
      • bdash 2y ago
        Passkeys are a different story than the keychain more generally. Other browsers that work with passkeys via the system APIs had to jump through hoops and get Apple's approval to do so: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_web-browser_public-key-credential https://developer.apple.com/documentation/bundleresources/en...
• NotPractical 2y ago
  Chrome uses it too. However the CDP protocol allows any local app to control the browser so you can use that to open the browser in windowless mode, examine the list of passwords at chrome://passwords, then open a bunch of tabs to all of those sites and extract the passwords from the HTML forms they get auto-inserted into.