0

The web passwords saved for a local user "UL" have disappeared after changing that local user's password and I need to recover them.

Here is my specific setup:

  1. I'm working on a MacBook Air M2 running Ventura 13.3.1 (a) ; I call the machine "mbam2" below
  2. Created standard (non-admin) user UL@mbam2 with a local password "foopass"
  3. Logged in to mbam2 as UL@mbam2 using "foopass"
  4. as UL@mbam2, signed into iCloud as [email protected] but did not enable iCloud keychain
  5. Browsed to website ABC.com and saved the password on UL's local keychain
  6. Logged out UL
  7. Logged in to mbam2 as admin and changed UL's local password "foopass" -> "barpass"
  8. Logged in to mbam2 as UL using "barpass" and was prompted for UIC password and previous UL password ("foopass") which I supplied
  9. At that time, I didn't realize something was wrong and I logged out of UL
  10. Upon logging into UL again using "barpass", I realized the web passwords saved locally for UL were gone

I've tried:

  • Time Machine restore - it doesn't seem to restore user accounts to the previous state
  • Actually, Time Machine doesn't even seem to store ~/Library folders containing Keychain files
  • Changing the UL password back to the previous "foopass" password - it didn't restore the passwords
  • Looking in the local Keychain directory - I see old Keychain files, but they don't seem to contain the missing passwords
  • Logging into icloud.com as UIC in case there is any indication of the web passwords; I could not see anything on icloud.com or on appleid.apple.com

Any pointers/suggestions/hints would be greatly appreciated.

2

1 Answer 1

1

After a lot of research, here is what I ultimately did which recovered the passwords I was looking for :

  • Back up the data in the user account manually as admin.
  • Completely delete the user account and delete all its folders as admin.
  • Recover the full account from time machine as admin.
  • Recreate the account while re-using the folders generated from Time Machine AND setting the same local login password as of the time of the Time Machine backup.
  • Login to the account.
  • Observe that the passwords are now there.
  • Manually re-merge data in the manual backup.
4
  • Did you found out why the passwords were lost?
    – Thinkr
    May 8, 2023 at 8:45
  • I have not found a specific reference explaining why the passwords disappeared. My theory is that this is a design intended to protect a user from a snooping administrator. When I changed the user account password, I did it from a separate administrator account instead of from within the user account. My belief is that this triggered the deletion of the web form filling so that an admin can't snoop on a user's personal accounts just by granting themselves access to the user account. I'd be very interested to know if anyone can confirm or explain further.
    – ac1501
    May 9, 2023 at 8:45
  • A few comments in case anyone ever tries to use this answer: (1) when I tried to time machine restore the UL user directory tree naively (i.e., without deleting the user first), macOS tried to do the restore but eventually failed with a nonsense error. (2) when re-creating the user, if I re-created the user with a different local password than what was in the TM backup, the passwords were again not present after restoring from backup. (3) one point of confusion for me is that the ~/Library directory is hidden by default, so I originally thought it was NOT in TM backup.
    – ac1501
    May 9, 2023 at 8:48
  • @Thinkr see my comment above in response to your question. I'm just learning to at-reference people.
    – ac1501
    May 9, 2023 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .