5 ms·
Are these supposed security experts completely ignorant about how Mac OSX Keychain works? This is the basis of much of the argument in favor of Chrome's approa
by abalone 13y ago
Are these supposed security experts completely ignorant about how Mac OSX Keychain works?
This is the basis of much of the argument in favor of Chrome's approach:
>In all cases, if you have access to the machine, all it takes is trivial software that's widely available to snoop on anyone else using the machine.
This has been repeated elsewhere including by the Chrome security engineer in so many words. Paraphrasing, "if you've got physical access to the machine, everything else is just theater, so we just go ahead and make that obvious."
But.... OSX requires the admin password before installing any software. That would seem to invalidate the above argument.
Or is there actually a way to bypass OSX Keychain.. and if so how "trivial" is it? Certainly nothing comes up in a quick google search. You'd think it'd be big news, that Apple's whole security framework is just "theater".
- ZeroGravitas 13y agoI'm fairly sure that I've installed (and run) Mac OS X apps via drag and drop with no admin prompt.
- abalone 13y agoHmm, maybe it's just the System and root Library folders that require authentication. But those would be what you'd need to access to install a keylogger or some such monitoring software, I'd guess.
- makomk 13y agoChrome already uses the OSX Keychain to store passwords. Firefox, on the other hand, stores them as plaintext unless you find and use the option to set a master password.
- abalone 13y agoThat's kind of beside the point. While Chrome may store passwords encrypted via Keychain, the problem is it readily displays them to the user via its UI without any re-authentication. Its creators think that any attempts to authenticate users beyond the system login are "theater". Is this really true for OS X Keychain? Are its admin password prompts for actions like installing system components or displaying secrets in the UI just theater?
- BitMastro 13y agoBut.... you don't have to install anything to get the password. Open a new tab, Google "safari reveal password javascript", open the second or third link, drag the bookmark, reveal the password.