> On Jun 17, 2015, at 1:17 PM, Doug Hill <[email protected]> wrote: > > For most of the security problems, you could rewrite your app to opt-out of > the insecure APIs, system services, etc. and use your own implementation. > (see Google Chrome not storing passwords in the Keychain anymore)
Does it? I’m using Chrome on Mac OS and it uses the Keychain. (I just opened Keychain Access and verified that a password I’d added in Chrome this morning shows up there.) Annoyingly, though, it doesn’t recognize Keychain items created by Safari, which means I have to keep looking up passwords in Keychain Access the first time I visit a site in Chrome. > This is obviously it’s own set of security issues. Totally. It would be a bad idea for developers to respond to this research by creating their own secure storage. (“I know! I’ll write the passwords to a plist and XOR the bytes with a 32-bit secret number I hardcode in my app!”) It does sound like there are some best practices that would defeat some of these attacks — like making sure to always create new Keychain items instead of re-using existing ones. Hopefully people with the expertise will publish some. (Maybe there are some in the paper? I haven’t had time to finish it yet.) —Jens _______________________________________________ Cocoa-dev mailing list ([email protected]) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to [email protected]
