Hacker News Reader

Please excuse my ignorance on the subject, but why does OS X need to encrypt and store my actual password? The prevailing best practice seems to be that app owners should only have enough information to determine whether a password is correct (e.g. hashing, bcrypt, etc), but not enough information to get the a user's actual password (without impractical heavy computation). Is there a good reason why this is any different for OS X?

View on HN

The keychain is the part of OS X that stores your passwords for websites (and other things), so you don't have to remember and type them in every time. Safari uses it to auto-fill login forms, for example.

Oh, I see, thank you! For some reason, I had assumed that it was used for storing local user accounts.

Hashing is only used to test if an entered password matches a stored one (without actually storing the password). It's no good if you need to retrieve the password to use later (which Keychain does).

This isn't a hole, and if anything, speaks to the quality of work that Apple's engineers did on Keychain.

Reply on news.ycombinator.com