Author Topic: Genieo again (Read 1407 times)

jchuzi · « **on:** September 02, 2015, 11:18:51 AM »

New adware scripts mouse clicks to access OS X Keychain, could lead to password theft

kimmer · « **Reply #1 on:** September 02, 2015, 01:48:42 PM »

Perhaps it's my sieve of a brain, but I don't understand how this can be installed without user permission in the first place.

jchuzi · « **Reply #2 on:** September 02, 2015, 03:09:35 PM »

QUOTE(kimmer @ Sep 2 2015, 02:48 PM) <{POST_SNAPBACK}>

Perhaps it's my sieve of a brain, but I don't understand how this can be installed without user permission in the first place.

From the article:

"Because this behavior does not rely on an OS X flaw, it is particularly dangerous and comes with a high potential for abuse. Such a request could be embedded in any seemingly innocuous file — like a photo — and is difficult to guard against without changing the behavior of the Keychain request dialog."

Xairbusdriver · « **Reply #3 on:** September 02, 2015, 04:43:33 PM »

The article mentions the problem is that the app automatically simulates the "Allow" button click. The main problem with Keychain has always been that any app you allow to access it can then access anything in Keychain!!! It's one of the reasons I never use it. It's just one of the costs of using "convenience" functions.

jchuzi · « **Reply #4 on:** September 02, 2015, 06:05:53 PM »

When I went from Snow Leopard to Yosemite, I noticed that Safari now has a Passwords preference pane, listing websites, User IDs, and passwords. Is that duplicated in Keychain or is it separate?

kimmer · « **Reply #5 on:** September 03, 2015, 11:10:05 AM »

QUOTE(Xairbusdriver @ Sep 2 2015, 01:43 PM) <{POST_SNAPBACK}>

The article mentions the problem is that the app automatically simulates the "Allow" button click. The main problem with Keychain has always been that any app you allow to access it can then access anything in Keychain!!! It's one of the reasons I never use it. It's just one of the costs of using "convenience" functions.

How do you manage to not use keychain? Doesn't your email program want to use it?

Xairbusdriver · « **Reply #6 on:** September 03, 2015, 12:27:28 PM »

Everything "wants" to use it, but that doesn't mean it has to. I simply use 1Password always. When an app asks if I want to save anything to KeyChain, I just hit the 'no thanks' button. Of course, Apple, in its infinite wisdom can and may store things in KC, and that data is always subject to being 'borrowed' by any app you 'allow' access, manually, or "virtually"! Unfortunately, we have no control over what Apple hard codes into the OS or its own apps.

News:

Author Topic: Genieo again (Read 1407 times)