Hacker News new | ask | show | jobs
by garethadams 4693 days ago
"Unauthenticated" except for the time you told Keychain to "Always allow" requests from Chrome.

However I'll admit that there's a big difference between what I expected Chrome to be using those passwords for (logging me into websites) and how it's ended up (making those visible to anyone looking at the settings page).
3 comments
masklinn 4693 days ago
> "Unauthenticated" except for the time you told Keychain to "Always allow" requests from Chrome.

1. that does not make it OK to display all cleartext passwords, Keychain requires the account password before displaying the cleartext. And keychain can optionally require the master password to be entered before providing a password for form-filling as well.

2. an other user notes above that, whether you "allow" or "always allow", Chrome will copy the entry it just got to a new keychain entry which it sets to always allow.

link
stephenr 4693 days ago
Chrome creates it's own keychain entries and sets them as "always allow from chrome" regardless of what the user does.

This is a problem entirely caused by Google

link
interpol_p 4692 days ago
Why can't Chrome do the same thing Safari does in that image? If the user wishes to see the password in plaintext, ask for their master keychain password first.
link