Security Flaw in OS X displays all keychain passwords in plain text

Re:Security Flaw in OS X displays all keychain passwords in ... by cocotino on Friday July 08, 2016 @09:09AM (#12055199)

This is bogus.

If you execute "security dump-keychain -d login.keychain":

1. If the keychain is unlocked (the keychain is unlocked by default after logging in, and you can check that by opening the Keychain Access app) a SecurityAgent window opens, and you must click the Allow button to dump the keychain. That cannot be scripted in an installation of a recent version of OS X which is not misconfigured.

2. If the keychain is locked (for example, by clicking the padlock in the Keychain Access app to lock it), it asks you for your user password, just like the Keychain Access app does.

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by headShrinker on Friday July 08, 2016 @09:55AM (#12055471)

Also, this ability to parse all the passwords unencrypted isn't a flaw and it isn't new. I ran this very command maybe 5 or 6 years also. Granted I was shocked to see all my passwords dump unhashed but you have to enter the users password and it makes sense that is the computer needs the passwords unhashed, there should be a secure command to gain access to them.

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by yberreby on Friday July 08, 2016 @10:32AM (#12055776)

Hashing keychain passwords would make no sense. You hash passwords when you want to check against them. When you actually need to retrieve them at some point, however, you encrypt them.

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by eeeeeeeeeeeee on Friday July 08, 2016 @11:37AM (#12056251)

Yep, just tested this myself and was immediately prompted for my password. No sensitive data was exposed if I simply clicked "deny."

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by brenton07 on Friday July 08, 2016 @01:39PM (#12057275)

We tested this on four machines and had no prompts for password authentication. Two of them are VERY close to clean installs with only Adobe CC and two or three other production software components installed, highest security settings for everything in preferences.

We haven't been able to figure out why some users are prompted and others are not.

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by merpnderp on Friday July 08, 2016 @09:53AM (#12055454)

I just replicated this and it is true for 10.11.5

[ Parent | on HN ]

Re:Security Flaw in OS X displays all keychain passwords in ... by Karunamon on Friday July 08, 2016 @11:04AM (#12056014)

Replicated it succeeding, or failing? It isn't possible to script the security window; the scripting system can't even see it.

http://prntscr.com/bqepwk

[ Parent | on HN ]