0

Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a keychain and then call the following command:

security find-internet-password -w -a [email protected] -s imap.email.com  <keychain-file>

Now if we let the security file access this keychain entry without asking for permission (because it's pretty annoying otherwise) then we have basically given anyone permission to run this command and whoever runs this command will be able to read the password. So naively it seems that storing a password in a keychain is not all that sage in comparison to storing it in a plaintext file.

Am I missing something? Also I tried to set the permission of the $(which security) binary to 700 but then the email program cannot run the security program so juts changing the permission of the security binary is not feasible.

Improve this question

2 Answers 2

Reset to default
1

This is precisely why you shouldn't grant the security program access to your keychain entries. In general, each keychain entry should only be readable (without prompting the user) by the specific program that uses it, i.e. your mail program should have access to your email account password, your favorite browser should have access to your web passwords, etc.

Note that this requires that the programs that use keychain-stored passwords must use keychain APIs directly, not just run the security program in the background. If they're using security, then you should complain to the developer that they're doing it wrong and forcing you to weaken your keychain's security significantly. (Or, since at least msmtp is open source, fix it yourself.)

Improve this answer
2
  • Actually both isync(aka mbsync) and msmtp are open sourced, but every tutorial I found online about using emacs as a mail reader described the type of setup that I wrote.
    – Pushpendre
    Dec 10, 2016 at 17:18
  • Do you know of examples of email programs that can replace msmtp etc. (either on OSX or Linux) that do things the right way?
    – Pushpendre
    Dec 10, 2016 at 17:22
1

I don't have any internet passwords stored in my keychain, but running security find-generic-password -w, I get this prompt:

security wants to use your confidential information

Similarly, the first time I use an ssh key, I have to re-enter a password before it becomes always-available.

In general, this is how password agents work: they aren't any better than having a plaintext file on-disk once you've loaded the agent up into memory and unlocked it, but they provide extra protection once they go out of memory, since the contents are stored on disk encrypted. So are they perfect? No, but they're definitely still better than not encrypting your secrets at all.

Improve this answer
3
  • Thank you for the reply. Will it be correct to say that once you click Always Allow then the password manager is as good as a plaintext file?
    – Pushpendre
    Dec 10, 2016 at 4:01
  • 1
    No, because the keychain is still locked when you're not logged in.
    – Stephen Touset
    Dec 10, 2016 at 4:30
  • @Pushpendre: I don't know about keychain, but some password managers permits access only to passwords that the application has asked for, not to the entire keyring. Other password manager must run with sufficient privilege to type the password on the application that requires it. But yes, in general, if you trust the program enough to run on your machine, you probably should trust it enough not to do anything too nasty.
    – Lie Ryan
    Dec 10, 2016 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .