Security Flaw in OS X displays all keychain passwords in plain text

Re:Security Flaw in OS X displays all keychain passwords in ... by csydas on Friday July 08, 2016 @08:03AM (#12054878)

Snippet from the man page for security:

https://developer.apple.com/legacy/library/documentation/Dar...

>dump-keychain [-adhir] Dump the contents of one or more keychains.

            -a              Dump access control list of items
            -d              Dump (decrypted) data of items
            -i              Interactive access control list editing mode
            -r              Dump raw (encrypted) data of items

I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dumps all data in plain-text as the article suggested. I am curious if the keychain was unlocked when they did it for whatever reason.

I still question why such an ability exists through terminal without more control, but it's not quite as described.

edit: was very unclear I was posting a snippet of the actual command. fixed

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by coldcode on Friday July 08, 2016 @08:14AM (#12054910)

dump-keychain: command not found

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by coldcode on Friday July 08, 2016 @08:16AM (#12054917)

http://apple.stackexchange.com/questions/184897/how-to-dump-... This is nothing new apparently

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by Karunamon on Friday July 08, 2016 @11:06AM (#12056026)

The name of the main command is 'security', with 'dump-keychain' being an argument.

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by csydas on Friday July 08, 2016 @08:25AM (#12054965)

ah, I was not clear I was posting a snippet from the man, and also forgot the link to it. mybad

[ Parent | on HN ]