why is it secure if i can access it from any apps?

[jf3096]

As long as I install this tools, I can get password or even search password any time I want. How can I ensure the security? Is there any theory or docs I can refer to?

[vladimiry]

You might want to start from here https://developer.apple.com/library/content/documentation/Security/Conceptual/keychainServConcepts/02concepts/concepts.html + this https://github.com/atom/node-keytar/blob/master/src/keytar_mac.cc

[dracan]

I'm still confused by this. I'm using Windows, and have an Electron app. If I build / install my Electron app so it has it's own executable, then save some credentials. Then I have a completely separate Electron app - this can still access the credentials. I don't get it - surely this renders the whole thing pointless? I'm obviously missing something though - so if anyone can help me understand, that would be greatly appreciated :)

[shiftkey]

@dracan keytar is about leveraging the OS for managing credentials associated with your apps, rather than rolling your own credential storage. If you want to isolate your applications credentials from everything else then I'd recommend using something else.

[dracan]

Thanks @shiftkey. I still don't understand what use-case this would have if any old app can access the app's credentials.

"keytar is about leveraging the OS for managing credentials associated with your apps, rather than rolling your own credential storage."

I don't want to roll my own credential storage - and I do want to leverage the OS for managing credentials associated with my app. I just don't want any old app to be able to access those credentials.

Reading some other issues in this repository - it sounds like other apps shouldn't be able to access my credentials - but when testing this doesn't seem to be the case.

[shiftkey]

@dracan

I just don't want any old app to be able to access those credentials.

The credential stores in the OS haven't been designed with that in mind (at least for macOS and Windows, I'm not that familiar with libsecret) - they let the user view and edit the credentials associated with their account arbitrarily.

Think of keytar as an interface on top of that.

[dracan]

@shiftkey Ah I see - so it's a user-level thing, rather than an app-level thing. Okay - thank you for your help and quick replies :)

[dracan]

Hi @shiftkey. Sorry to pester you again :) But If this is at a user-level, not an app-level - then I can't think of any use-case that this could possibly fulfil? What's this library for then? Also, looking at some of the other issues (eg. #50, and a few others) - it seems like other people also assume that this is for app-level credentials too. Then there's blog post like this, which also seem to think the same thing. I'm just a bit confused, as there's seems to be a lot of misunderstanding around this library.

[vladimiry]

I'm just a bit confused, as there's seems to be a lot of misunderstanding around this library.

@dracan it's clearly described in readme that this module interacts with the system's keychain. So before using it, the next step would be to figure out what is the system keychain in order to determine how it's suitable for your needs.

[dracan]

@vladimiry Understood. However, as it's clear that I'm not the only one confused by this - and people are most likely using this library blindly, and haven't gone to the effort that I did of creating another Electron app to test that the other app can't access the credentials - then I would strongly recommend updating the readme with a brief explanation of when this library should and shouldn't be used. Otherwise, it's doing more harm than good. I came to this library from the above-mentioned blog post - so I perhaps wrongly assumed what the library did from the get-go. I'm clearly not the only one though.

[ccnokes]

I agree here with @dracan -- a short explanation would be nice on how each of these systems store credentials, how they're encrypted, and what the access control is like for retrieving credentials. If not that, maybe at least links to read about that.

Unfortunately, the Windows Credential Manager is sort of a joke in terms of security but it seems to be what is recommended for apps to use.

[kinoli]

So if this isn't the solution to secure passwords and privateKeys, etc, what is a better option?

[6zz]

@dracan aside from the issue you have raised, in your Electron app js code, if you have keytar.addPassword('KeytarTest', 'AccountName', 'secret');; It is still not secure because one can unobfusticate your code to get to those values.