Hacker News Reader

> AFAIK, `security` has no access to the iCloud Keychain where Safari stores its passwords. If you don't have iCloud Keychain enabled, I believe Safari stores its passwords in a traditional file-based keychain but those items should have ACLs on them.

Clarifying my own comment.

Safari stores its passwords in the data protection keychain. This is called "Local Items" in the Keychain Access app if iCloud Keychain is not enabled. If it is enabled, it's called "iCloud Keychain". Either way, `security` does not enumerate any items from the data protection keychain, only from the file-based keychains. And again, all the items in those keychains should have ACLs on them.

Custom keychains are also available if you worry about malware dumping unlocked keychain data via kernel privilege escalation (to bypass ACLs). For critical items that you decrypt once a year, it doesn't make much sense to use the resident login and iCloud keychains.

ACLs shouldn't be overlooked though: manual keychain items use the default ACL configuration and require user confirmation, which means you need to authenticate N times to access N items.

> Items within the traditional keychain can have ACLs applied to them. When you run `security dump -d`, it will only be able to dump items from a traditional keychain

Could it be that the Terminal has full access then? I've never been asked for a password, or had a restriction of any kind put on me, when using the `security` command. Those prompts you speak of are for the "Keychain Access" GUI, no?

Access is gated upon `/usr/bin/security`, not the Terminal app.

The security prompt to "Allow All", "Allow", or "Deny" when a process tries to access a keychain item's value is a GUI window, but it's not part of any app.