0

Is this possible?

I know some users use this function to recover forgotten passwords, however revealing a password in plaintext feels like extremely bad practice.

In my case, multiple users share a workstation, and all have the admin password. Keychain stores passwords to my personal accounts that we do not share. My password is sitting there waiting to be ripped off.

  • 1
    Since the others also have admin rights, even if disabling "Show password:" could be none, they could reenable it... get other's passwords and then disable it again. You probably wouldn't know they did either. – user3439894 Feb 18 '16 at 21:15
1

The keychain is an encrypted container and only the user who has the password can unlock it. Being an admin on a computer does not allow you to unlock the keychain. Not even root can do it.

Of course, as an admin, there are ways to install software and get the data but it isn't as simple as opening the keychain and looking.

  • It is as simple as double clicking the link in Keychain and then clicking the "show password" checkbox. – pinhead Feb 18 '16 at 21:24
  • Only if the keychain is unlocked, which can only be done if you know the password for the users account. When you log into your computer, your keychain is automatically unlocked, but it won't be for another user of the computer. – iWill Feb 18 '16 at 21:30
  • Ah yes. Unfortunately all the users that share this machine are the same "user" – pinhead Feb 18 '16 at 21:32
  • In that case, you can create a new keychain that has a password only you know. You may have to spend some extra effort to make sure your passwords get stored there (e.g. you may have to do it manually in Keychain Access) – iWill Feb 18 '16 at 21:36
  • 2
    From a security perspective, you'll generally have problems if multiple people share the same account. If you don't trust them, you should really have your own account. – iWill Feb 18 '16 at 21:38
0

I suggest you set up multiple accounts. You could set up one admin account (that you can all access for adding applications etc. across users) and then individual user accounts. You'll be able to share data etc. Apple Sharing Data Among Users Article (El Capitan).

Accounts exist for this purpose so I'm optimistic you can set them up to fulfill your team's specific needs.

Otherwise I would treat it as a public computer (don't save passwords/use incognito/delete all data from browser after using).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .