OSX password script for everyone to know

Re:OSX password script for everyone to know by brockrockman on Thursday September 13, 2012 @06:28PM (#4518979)

Hardly a security flaw. How do you expect Safari/Chrome autofill the same passwords? And after the password is auto-filled any JavaScript can access the input's value attribute.

I use this in my .emacs so Emacs can grab passwords from Keychain, but the same approach would work in bash too: (defun find-keychain-password (host) () (condition-case nil (let ((passstr (second (split-string (first (process-lines "/usr/bin/security" "find-internet-password" "-gs" host)) ": ")))) (substring passstr 1 (1- (length passstr)))) (error nil)))

[ Parent | on HN ]

Re:OSX password script for everyone to know by jdechko on Thursday September 13, 2012 @06:48PM (#4519071)

I'm inclined to agree. It looks like this is the same "hack" detailed last week, though through a terminal command instead of an application. As we learned last week, by default, OS X is set to never lock the keychain once it is logged in. It's a conscious choice of default set by Apple. If you care about tighter security, just change the autolock time or use separate keychains.

[ Parent | on HN ]

Re:OSX password script for everyone to know by Bakkot on Thursday September 13, 2012 @09:24PM (#4519562)

No, last week's was root only, operated by searching through RAM for various keys, and was notable for displaying passwords for every logged-in user, which this will not do.

[ Parent | on HN ]

Re:OSX password script for everyone to know by sitharus on Thursday September 13, 2012 @07:38PM (#4519238)

That's a handy function! Thanks for sharing :)

[ Parent | on HN ]