0

Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a keychain and then call the following command:

security find-internet-password -w -a user@email.com -s imap.email.com  <keychain-file>

Now if we let the security file access this keychain entry without asking for permission (because it's pretty annoying otherwise) then we have basically given anyone permission to run this command and whoever runs this command will be able to read the password. So naively it seems that storing a password in a keychain is not all that sage in comparison to storing it in a plaintext file.

Am I missing something? Also I tried to set the permission of the $(which security) binary to 700 but then the email program cannot run the security program so juts changing the permission of the security binary is not feasible.

1

This is precisely why you shouldn't grant the security program access to your keychain entries. In general, each keychain entry should only be readable (without prompting the user) by the specific program that uses it, i.e. your mail program should have access to your email account password, your favorite browser should have access to your web passwords, etc.

Note that this requires that the programs that use keychain-stored passwords must use keychain APIs directly, not just run the security program in the background. If they're using security, then you should complain to the developer that they're doing it wrong and forcing you to weaken your keychain's security significantly. (Or, since at least msmtp is open source, fix it yourself.)

  • Actually both isync(aka mbsync) and msmtp are open sourced, but every tutorial I found online about using emacs as a mail reader described the type of setup that I wrote. – Pushpendre Dec 10 '16 at 17:18
  • Do you know of examples of email programs that can replace msmtp etc. (either on OSX or Linux) that do things the right way? – Pushpendre Dec 10 '16 at 17:22
1

I don't have any internet passwords stored in my keychain, but running security find-generic-password -w, I get this prompt:

security wants to use your confidential information

Similarly, the first time I use an ssh key, I have to re-enter a password before it becomes always-available.

In general, this is how password agents work: they aren't any better than having a plaintext file on-disk once you've loaded the agent up into memory and unlocked it, but they provide extra protection once they go out of memory, since the contents are stored on disk encrypted. So are they perfect? No, but they're definitely still better than not encrypting your secrets at all.

  • Thank you for the reply. Will it be correct to say that once you click Always Allow then the password manager is as good as a plaintext file? – Pushpendre Dec 10 '16 at 4:01
  • 1
    No, because the keychain is still locked when you're not logged in. – Stephen Touset Dec 10 '16 at 4:30
  • @Pushpendre: I don't know about keychain, but some password managers permits access only to passwords that the application has asked for, not to the entire keyring. Other password manager must run with sufficient privilege to type the password on the application that requires it. But yes, in general, if you trust the program enough to run on your machine, you probably should trust it enough not to do anything too nasty. – Lie Ryan Dec 10 '16 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.