03/19/2003, 8:40am, EST
Wednesday, March 19th[::FROM::] [::SiteName::]
OS X 10.2.4 bug exposes .Mac passwords
"This bug has been confirmed in Mac OS X 10.2.4 and also occurs in a recently leaked build of 10.2.5 (6L11) and may affect older versions as well. There is a major security hole in the Keychain Access application."When you open up the Keychain application, you will see a list of stored passwords for the various services, such as your e-mail, Airport and iChat. When a user opens the Keychain application and selects the iTools password keychain and then clicks on the "show passphrase" option (on bottom of page), the user's .Mac password will be exposed [in plain text] without authentication.
"The only way to protect the password is to lock all keychains; by default Apple sets all keychains to unlock. Whenever you unlock a keychain all of them unlock. Note: This bug only affects a user's .Mac password, not other passwords in the Keychain. [Other Keychain password entries require authentication before the display of the password. Users can also change the 'Access Control' of the password to protect the display of this password.]" [updated]
[::digg_button::]
[::news_tags::]
, 
[::delicious::][::slashdot::][::digg::][::buzz::] [::twitter::], 
[::doclix::]
[::boottext::] [::bootmark::]
[::layout::]
[::google::]
Top
subscribe to comments
for this article
posted by MacNN.com Reader
posted by MacNN.com Reader
I you are paranoid about it, you can change it with Keychain Manager:
- select your .Mac keychain item
- select the "Access control" tab
- change access to "Confirm..."
posted by MacNN.com Reader
This reminds me of some hullabaloo with an earlier version of X (or 9, don't remember which). back then, the keychain always asked for your password to open up, which annoyed many users, so someone came up with a script to auto-unlock the keychaing at boot up (or whenever you double-clicked the script). But people went nuts because the password was stored unencrypted (if you can read the script, you have the password! Aiiiggghhh!!!). It took awhile for a sane person to jump in and say "Hey, if someone has access to your machine to read the script, they probably have access to run it, and then they can just access your keychain anyway."
posted by MacNN.com Reader
posted by MacNN.com Reader
posted by MacNN.com Reader
Open the Keychain Access application and click on the 'iTools password' entry. Click on the Access Control tab, and notice that this key is set to 'Always allow access to this item.' That's the "bug." To fix it, just click on 'Confirm before allowing access' and 'Ask for Keychain password.' Click Save Changes and enter your Keychain password. That's the end of the "bug."
Part of the power of Keychain Access is that it lets you be as secure as you want to be; you can "introduce" this bug in other passwords just by switching their settings to 'Always allow access to this item.' So please, don't worry about this particular security bug -- it's really nothing more than a switch that wasn't set to the highest security level upon leaving the factory.
_________________________
posted by MacNN.com Reader
I wrote a similar message to this effect five minutes ago, and it's now been deleted.
For the record, you can find the original text on macosxhints.com ... in the future, if you feel like copying my work again, you could at least provide an attribution to the source.
-rob.
posted by MacNN.com Reader
posted by MacNN.com Reader
posted by MacNN.com Reader