Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this community
I'm a newb of OS X (or any flavor of *Nix for that matter) so this came to mind lately.. As the Console.app logs every single process that's running, does to also mean passwords & such are also logged aside from Keychain?
I noticed for example, when creating a Workflow in Automator and telling it to follow your moves; it will also log any password you enter along the way in plaintext..
Is this the case, and if so, isn't this a security risk?
Thx in advance!
No, Console won’t log any of your passwords. It only logs normal process activity like load, errors, warnings, etc.
Certain user activity that can causes a major change in the program’s behaviour will also be logged. Opening and saving documents is one such activity.
Automator logs your password because it doesn’t know you are entering your password; it only knows that keyboard input is being received. Recording actions in Automator is very literal. It records the points being clicked, not the buttons. It records the delay between two actions; it does not detect if a previous action has completed or not. Similarly, it records the buttons being pressed, not what those buttons do or even if the key presses are for a text field or a game.
The answer is 2 sided.
No Console.app doesn't log anything. Console.app simply display logfiles feeded by applications and MacOS X itself.
Yes you can see clear text password logged with Console.app.
How such a password disclosure may happen?
Here are the causes by order of decreasing probability:
I inadvertantly typed my password within an admin right checking window.
I didn't notice that this window was first asking me an admin account and I typed there my password. This one is duly registered in /var/log/secure.log as if it is an admin account.
I typed my password within a badly conceived software which will log it in /var/log/system.log with some other pieces of information. This may be due to either an internal debugging function or a tracking function.
Keyboard sniffers and RATs are some dangerous piece of software which see passwords in clear (they may even see much more confidential pieces of information). Hence they must be very carefully coded so as to avoid any leak of the information they see.
In case n° 1: you just have to change it and do the same change wherever you used the same password. In case n° 2: same corrective action concerning your disclosed password. And you could signal the problem to the author of the software if you think they are among the software editors who may understand and fix this security vulnerability.
Console.app shows what processes have written to files or syslog or the Apple logger. What gets written there depends on the application and what the developers have decided to write. I have seen apps where bad developers have left debug logging in but these are very rare.
If the developers use the Apple authentication framework to get a password for an admin user then the application does not see the password so the application cannot write it to a log.
As @duci9y says Autimator does not know that this is a password and so just treats it like any text, writing it to stdout.
No, Console.app does not log passwords in plaintext.
Console.appisn't the culprit but a witness.