4

Whenever I use the SVN command-line client on my Mac, it stores the password to os keychains without my permission.

While the immediate issue is with the SVN command-line client, the scope of this question is more general.

There are very few situations in which I want a password to reside anyplace either than (a) my head, or (b) an encrypted DMG whose password is saved only in my head.

Once this unauthorized password capture has been made, then every single time I access that repository via Subclipse, Keychain butts in, asking me (if I remember right) to deny once, allow once, or allow indefinitely, BEFORE I can reach the Sublclipse sign-on dialog. To prevent this, I have to go into Keychain Access, and delete the record -- which then reappears as soon as I use the command-line SVN client. Thus, Keychain defeats its whole purpose of "convenience."

How do I prevent this unauthorized capture and storage? An answer specific to the SVN command-line client would be good; a more general answer would be better.

Improve this question
4
  • 1
    Doesn't the keychain meet your requirements in b - it is in an encrypted place where the password is only in your head?
    – mmmmmm
    Commented Jun 22, 2019 at 10:26
  • NO, it does NOT, when I am NOT given the opportunity to decline to have the password stored there! Keychain is about CONVENIENCE -- SOMEBODY ELSE's idea of convenience, NOT security! Once a password is stored there, and an application is authorized to use the stored password, then ANYBODY gaining access to my computer has unfettered access to whatever the password protects, which defeats the whole purpose of having a password in the first place!
    – hbquikcomjamesl
    Commented Jun 23, 2019 at 1:27
  • 1
    @hbquikcomjamesl What do mean and an application is authorized to use the stored password? You have to give that application explicit permission.
    – user7886229
    Commented Jun 23, 2019 at 2:12
  • Right. And in the case of Subclipse, Keychain (at least, I THINK the dialog is coming from Keychain) will keep asking me to allow (with the Keychain password) or deny access, every time Subclipse tries to access a repository with a password cached in Keychain, until I get rid of the cached password. As it happens, I just learned how to suppress all password caching in the SVN client's configuration files. But I'd like to know if there's something I can do from the Keychain end, to suppress (or at least require me to specifically authorize) caching.
    – hbquikcomjamesl
    Commented Jun 23, 2019 at 2:20

1 Answer 1

Reset to default
2

I have managed to find an SVN-specific answer.

It seems that the SVN client itself uses whatever password caching functionality is available on the underlying platform, but this can be controlled with a configuration file.

Specifically, configuration files for SVN can be found on a Mac or *nix box in the "invisible" directory ~/.subversion (i.e., ".subversion" within your home directory). In the current release, to unconditionally suppress all password caching, go to %/.subversion, and edit the "servers" file in the editor of your choice. Find the [global] section, and within it, the commented-out line, 

# store-passwords = no

Remove the pound-sign and the leading space (if you leave the leading space in, the svn client will fail -- I learned this the hard way). The line should now read

store-passwords = no

And that will unconditionally suppress password caching in the Eclipse client.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .