4 ms·
Please excuse my ignorance on the subject, but why does OS X need to encrypt and store my actual password? The prevailing best practice seems to be that app own
by callmevlad 14y ago
Please excuse my ignorance on the subject, but why does OS X need to encrypt and store my actual password? The prevailing best practice seems to be that app owners should only have enough information to determine whether a password is correct (e.g. hashing, bcrypt, etc), but not enough information to get the a user's actual password (without impractical heavy computation). Is there a good reason why this is any different for OS X?
- frl374 14y agoThe keychain is the part of OS X that stores your passwords for websites (and other things), so you don't have to remember and type them in every time. Safari uses it to auto-fill login forms, for example.
- callmevlad 14y agoOh, I see, thank you! For some reason, I had assumed that it was used for storing local user accounts.
- cheald 14y agoHashing is only used to test if an entered password matches a stored one (without actually storing the password). It's no good if you need to retrieve the password to use later (which Keychain does). This isn't a hole, and if anything, speaks to the quality of work that Apple's engineers did on Keychain.