Techsurvivors

Welcome to Techsurvivors => Tech => Topic started by: jchuzi on September 02, 2015, 11:18:51 AM

Title: Genieo again
Post by: jchuzi on September 02, 2015, 11:18:51 AM
New adware scripts mouse clicks to access OS X Keychain, could lead to password theft
Title: Genieo again
Post by: kimmer on September 02, 2015, 01:48:42 PM
Perhaps it's my sieve of a brain, but I don't understand how this can be installed without user permission in the first place.
Title: Genieo again
Post by: jchuzi on September 02, 2015, 03:09:35 PM
QUOTE(kimmer @ Sep 2 2015, 02:48 PM) <{POST_SNAPBACK}>
Perhaps it's my sieve of a brain, but I don't understand how this can be installed without user permission in the first place.
From the article:

 "Because this behavior does not rely on an OS X flaw, it is particularly dangerous and comes with a high potential for abuse. Such a request could be embedded in any seemingly innocuous file — like a photo — and is difficult to guard against without changing the behavior of the Keychain request dialog."
Title: Genieo again
Post by: Xairbusdriver on September 02, 2015, 04:43:33 PM
The article mentions the problem is that the app automatically simulates the "Allow" button click. The main problem with Keychain has always been that any app you allow to access it can then access anything in Keychain!!! It's one of the reasons I never use it. It's just one of the costs of using "convenience" functions. rolleyes.gif
Title: Genieo again
Post by: jchuzi on September 02, 2015, 06:05:53 PM
When I went from Snow Leopard to Yosemite, I noticed that Safari now has a Passwords preference pane, listing websites, User IDs, and passwords. Is that duplicated in Keychain or is it separate?
Title: Genieo again
Post by: kimmer on September 03, 2015, 11:10:05 AM
QUOTE(Xairbusdriver @ Sep 2 2015, 01:43 PM) <{POST_SNAPBACK}>
The article mentions the problem is that the app automatically simulates the "Allow" button click. The main problem with Keychain has always been that any app you allow to access it can then access anything in Keychain!!! It's one of the reasons I never use it. It's just one of the costs of using "convenience" functions. rolleyes.gif

How do you manage to not use keychain? Doesn't your email program want to use it?
Title: Genieo again
Post by: Xairbusdriver on September 03, 2015, 12:27:28 PM
Everything "wants" to use it, but that doesn't mean it has to. I simply use 1Password always. When an app asks if I want to save anything to KeyChain, I just hit the 'no thanks' button. Of course, Apple, in its infinite wisdom can and may store things in KC, and that data is always subject to being 'borrowed' by any app you 'allow' access, manually, or "virtually"! Unfortunately, we have no control over what Apple hard codes into the OS or its own apps. wallbash.gif