0

Is this possible?

I know some users use this function to recover forgotten passwords, however revealing a password in plaintext feels like extremely bad practice.

In my case, multiple users share a workstation, and all have the admin password. Keychain stores passwords to my personal accounts that we do not share. My password is sitting there waiting to be ripped off.

Improve this question
1
  • 1
    Since the others also have admin rights, even if disabling "Show password:" could be none, they could reenable it... get other's passwords and then disable it again. You probably wouldn't know they did either.
    – user3439894
    Commented Feb 18, 2016 at 21:15

2 Answers 2

Reset to default
1

The keychain is an encrypted container and only the user who has the password can unlock it. Being an admin on a computer does not allow you to unlock the keychain. Not even root can do it.

Of course, as an admin, there are ways to install software and get the data but it isn't as simple as opening the keychain and looking.

Improve this answer
5
  • It is as simple as double clicking the link in Keychain and then clicking the "show password" checkbox.
    – pinhead
    Commented Feb 18, 2016 at 21:24
  • Only if the keychain is unlocked, which can only be done if you know the password for the users account. When you log into your computer, your keychain is automatically unlocked, but it won't be for another user of the computer.
    – iWill
    Commented Feb 18, 2016 at 21:30
  • Ah yes. Unfortunately all the users that share this machine are the same "user"
    – pinhead
    Commented Feb 18, 2016 at 21:32
  • In that case, you can create a new keychain that has a password only you know. You may have to spend some extra effort to make sure your passwords get stored there (e.g. you may have to do it manually in Keychain Access)
    – iWill
    Commented Feb 18, 2016 at 21:36
  • 2
    From a security perspective, you'll generally have problems if multiple people share the same account. If you don't trust them, you should really have your own account.
    – iWill
    Commented Feb 18, 2016 at 21:38
1

I suggest you set up multiple accounts. You could set up one admin account (that you can all access for adding applications etc. across users) and then individual user accounts. You'll be able to share data etc. Apple Sharing Data Among Users Article (El Capitan).

Accounts exist for this purpose so I'm optimistic you can set them up to fulfill your team's specific needs.

Otherwise I would treat it as a public computer (don't save passwords/use incognito/delete all data from browser after using).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .