Many email programs such as isync
and msmtp
provide the facility of specifying a command that once executed prints the user's password to stdout
. For example on OSX we can store the password in a keychain and then call the following command:
security find-internet-password -w -a [email protected] -s imap.email.com <keychain-file>
Now if we let the security
file access this keychain entry without asking for permission (because it's pretty annoying otherwise) then we have basically given anyone permission to run this command and whoever runs this command will be able to read the password. So naively it seems that storing a password in a keychain is not all that sage in comparison to storing it in a plaintext file.
Am I missing something? Also I tried to set the permission of the $(which security)
binary to 700
but then the email program cannot run the security
program so juts changing the permission of the security
binary is not feasible.