Did you run the AppleScript? I got the expected error:

> error "System Events got an error: Can’t get group 1 of window 1 of process \"SecurityAgent\". Invalid index." number -1719 from group 1 of window 1 of process "SecurityAgent"

You're not supposed to be able to script SecurityAgent – and it doesn't work on my computer. Specifically, security windows should appear empty when read by other processes.

Snippet from the man page for security:

https://developer.apple.com/legacy/library/documentation/Dar...

>dump-keychain [-adhir] Dump the contents of one or more keychains.

            -a              Dump access control list of items
            -d              Dump (decrypted) data of items
            -i              Interactive access control list editing mode
            -r              Dump raw (encrypted) data of items

I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dumps all data in plain-text as the article suggested. I am curious if the keychain was unlocked when they did it for whatever reason.

I still question why such an ability exists through terminal without more control, but it's not quite as described.

edit: was very unclear I was posting a snippet of the actual command. fixed

dump-keychain: command not found

http://apple.stackexchange.com/questions/184897/how-to-dump-... This is nothing new apparently

The name of the main command is 'security', with 'dump-keychain' being an argument.

ah, I was not clear I was posting a snippet from the man, and also forgot the link to it. mybad

I can confirm that at least on mine the passwords are definitely plain text (also includes some private keys) but the Apple script doesn't work for me so there doesn't seem to be a way to suppress the Allow/Deny box.

I am a little surprised it doesn't ask foe the keychain password.

I believe you've surfaced the real issue – there's no confirmation prompt that requires the keychain password.

On 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.

The new security was added in 10.11 afaik

Wonder if it got bumped on accident on a recent update. My system has been modified to allow system access, so its less surprising (although still a flaw). But we did it on machines by people that are probably TOTALLY unaware of those 10.11 changes and wouldn't have the know how to modify something like that, and it still worked on their machines.

They might have turned it down or off because it was buggy.

Trying to get a password out of my keychain using Screen Sharing completely hosed it (10.11 initial release). Even opening Keychain Access resulted in an instant freeze and spinning wheel. I ended up having to completely recreate my keychain and reset a lot of passwords.

I can confirm this works on 10.11.5 ( El Capitan ). To confirm, you can "cat keychain.txt | grep -i SECTION_OF_YOUR_PASSWORD". However, you must click Allow on each dialog, or Always Allow.