Many email programs such as
msmtp provide the facility of specifying a command that once executed prints the user's password to
stdout. For example on OSX we can store the password in a keychain and then call the following command:
security find-internet-password -w -a email@example.com -s imap.email.com <keychain-file>
Now if we let the
security file access this keychain entry without asking for permission (because it's pretty annoying otherwise) then we have basically given anyone permission to run this command and whoever runs this command will be able to read the password. So naively it seems that storing a password in a keychain is not all that sage in comparison to storing it in a plaintext file.
Am I missing something? Also I tried to set the permission of the
$(which security) binary to
700 but then the email program cannot run the
security program so juts changing the permission of the
security binary is not feasible.