Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [keychain]

For security questions about Apple's Keychain Access app and the keychain file format on macOS and iOS

2
votes
1answer
48 views

Why is GPG-agent still caching my passphrase?

I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including: default-cache-ttl 0 max-cache-ttl 0 (also flipped the bit to 1) within ~/.gnupg/gpg-agent.conf ...
5
votes
2answers
420 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
2
votes
2answers
74 views

What format is an decrypted RSA private key in, specifically in OS X Keychain?

I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
2
votes
1answer
77 views

Why does not updating a MacOS keychain password cause applications to become troublesome? [closed]

I've changed my Macbook computer's password in using recovery mode. I'd changed it once normally, then it suddenly "stopped working" (or I started "mis-remembering" it after using it a few times, ...
0
votes
0answers
20 views

Determine location of binary reference in macOS keychain dialog

Here is an example dialog: In this example, I am fairly certain that the binary security is the one located at /usr/bin/security, but how can I be sure? The ? button simply brings up a Mac Help ...
0
votes
1answer
147 views

Creating self-signed root CA using MacOS Keychain

I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that. For knowledge purpose, I'd like to create a Root, and ...
0
votes
1answer
140 views

Stolen Google OAuth refresh token

I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account. Is the old OAuth ...
4
votes
2answers
386 views

Entropy on native memorable password on macosX keychain

I have been trying to find information on this. But I haven't found anything online. When you use the password manager on mac, it can provide "memorable" passwords. For example pick3"enigma. (You ...
0
votes
0answers
88 views

MacOS keychain encryption

There has been big media coverage that an application can just go and read the keychain without needing the master password, root access or anything. It just needs to be executed. But one thing I ...
1
vote
1answer
105 views

what does “no value specified” default to in keychain on osx?

In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me ...
1
vote
0answers
240 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
1
vote
2answers
324 views

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

I am trying to test the following setup: A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates: Client Public Key: ...
3
votes
2answers
4k views

Can OpenSSL verify a public key - intermediate CA certificate chain with a Root CA certificate?

I tried to run the following shell command: openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem where publickey_imcert_chain.cert is a chain of: servercert.pem (public key signed by ...
0
votes
1answer
322 views

Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app?

I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, ...
0
votes
2answers
312 views

Is a password in keychain more secure than storing password in plaintext?

Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a ...
4
votes
1answer
371 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
1
vote
1answer
114 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
5
votes
1answer
611 views

Keychain-dumper and Secure Enclave

Is it possible to use keychain-dumper to extract private keys that are protected by the secure enclave? Keychain-dumper works with "/private/var/Keychains/keychain-2.db". If a private key is ...
10
votes
1answer
1k views

Secure Enclave and keychain security

I've read the WWDC 2015 article from Apple, which says that: We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around ...
2
votes
1answer
6k views

Keychain vs KeyStore vs TrustStore

I'm quite confused between the three, and a Google search didn't come up with much. Can someone please explain?
2
votes
2answers
1k views

Hardware-backed Keychain for iOS and Android

I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/...
1
vote
0answers
1k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE ...
3
votes
1answer
582 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
2
votes
0answers
335 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
1
vote
1answer
832 views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
3
votes
0answers
90 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
5
votes
1answer
342 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
2
votes
1answer
133 views

Apple's Keychain - good security?

This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." Why should ...
2
votes
1answer
170 views

KeyChain Access and GPG Keychain - should those be running simultaneously?

I have installed GPG Suite and found out also during this time that my OS X has some KeyChain Access app that stores all my passwords under my screenlock password - total news to me. Can I get rid of ...
4
votes
0answers
2k views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
1
vote
1answer
326 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to encrypt/...
0
votes
1answer
188 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
6
votes
3answers
5k views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
1
vote
1answer
414 views

Can any malware access the OSX keychain data

I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...
7
votes
4answers
3k views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
0
votes
3answers
2k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
2
votes
1answer
741 views

How is the iOS KeyChain master key derived?

I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect. On iOS there is no user account password, only a ...
8
votes
3answers
682 views

How secure is OS X's Keychain access control?

On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access. Supposedly, the system saves not only the binary path, but also its hash in ...