Keychain: "security add-internet-password" (cloned entries due to Safari)

"atyp"<blob>="mrof" 
 
…
 
"atyp"<blob>="form"

Well, that’s weird. Note how “mrof” is “form” backwards. It’s almost like

security

-t form

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

I got it already and wrote an AppleScript around it (as stated here). But I am still wondering, why does Safari updates the entry in the keychain every time when logging in? Even worse, its overwriting the values in the Commentaries field with the value "default". I found it very usefull to have the email address in the Commentaries field (when creating a new account for a disussion forum where I am requested to provide my contact and verification email for example. In case I've changed the password in the forum and didn't update the keychain, I know at least to which email I have to request the notification for restoring the password). Thus, overwriting it each time with just "default" is complete nonsense.

So, is there a toggle in Safari (com.apple.Safari.plist???) or any other solution to switch this nonsense off?

“Why” questions are hard to answer.

My recommendation is that, if this particular behaviour is causing you grief, file a bug explaining why it’s a problem and what you’d like to see happen instead. That way the folks responsible can consider your feedback as they’re working on the code.

Please post your bug number, just for the record.

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Ritter, I have found the same thing - I think it is a bug in /usr/bin/security

1) I assume that, if yiou are using security add-internet-password to update an existing record, all the attributes have to match exactly. Otherwise, it creates a new record.

2) Several current entires in my keychains (OS 10.9.5) have 0x00000000 blob entries.

Of course, there seems to be no way to use security add-internet-password ... -w newPW -U to create blobs containing anything but four character types :-(

3) I also tried to write a script to reset passwords. For comparison, here is my Perl script:

my $newPW  = 'SuperSecure99';
my $chain  = '~/Library/Keychains/Telstra\ ACCOUNT-01.keychain';
###############################################################################
`security unlock-keychain $chain`;
#
# Match lines like:  0x00000007 <blob>="gmt.dir.telstra.com (n123456)"
#
# to get list of passwords to update
#
my @names = split /\n/, `security dump-keychain $chain | grep '007 <blob>="' `;
map s/.*="(.+)"/$1/, @names;
foreach my $name (@names)
{
    my $serv = $name; $serv =~ s/ .*/
    my @keys = split /\n/,
                `security find-internet-password -s $serv $chain`;
    my $acct = (grep s/.*"acct"<blob>="(.+)"/$1/,  @keys)[0];
    my $atyp = (grep s/.*"atyp"<blob>=(\w+)/$1/,    @keys)[0];
    my $icmt = (grep s/.*"icmt"<blob>="(.+)"/$1/,  @keys)[0];  # Comment
    my $desc = (grep s/.*"desc"<blob>="(.+)"/$1/,  @keys)[0];  # Kind
    my $ptcl = (grep s/.*"ptcl"<uint32>="(.+)"/$1/, @keys)[0];  # Where URI
    my $path = (grep s/.*"path"<blob>="(.+)"/$1/,  @keys)[0];  # Where URI
 
    my $cmd = "security add-internet-password ";
    if ( defined $acct ) { $cmd .= "-a $acct "  }
    if ( defined $desc ) { $cmd .= "-D '$desc' " }
    if ( defined $icmt ) { $cmd .= "-j '$icmt' " }
    if ( defined $path ) { $cmd .= "-p $path "  }
    if ( defined $ptcl ) { $cmd .= "-r '$ptcl' " }
    $cmd .= "-s $serv ";
    if ( defined $atyp )
    {
        if ( $atyp eq "0x00000000 " ) { $atyp = '0000' }
        $cmd .= "-t '$atyp' "
    }
    $cmd .= "-w $newPW -U $chain";
    print "$cmd\n";
    `$cmd`;
}

One of the 40plus records fails with security: SecKeychainAddInternetPassword /Users/nigel/Library/Keychains/Telstra ACCOUNT-01.keychain: The specified item already exists in the keychain. It is the only one that does not have a duplicate created!

This sounds similar to a problem I encountered with the Keychain UI. Effectively I have a separate keychain to store my bank information. When I go to my bank website, Safari requests that I unlock the keychain. If I allow this, then Safari copies the keychain item from "bank" to "login", thus eliminating the security benefit.

https://openradar.appspot.com/radar?id=4965515323768832

Same thing?