On Mon, Mar 10, 2008 at 3:01 PM, Aric Guite <[EMAIL PROTECTED]> wrote: > if it is as trivial to write software (maliciously or otherwise) that will > delete any subset of the keychain as you say, then my keychain isn't > safe at all.
That depends on what you mean by safe. The keychain is designed to prevent malicious applications from being able to learn or use passwords you have saved in other applications, and in that regard it is indeed safe (at least, I'm not aware of any general exploits that allow password extraction). It's not safe from deletion, but no file that you own is safe from deletion by software that you run. > Because the data I create with your software is vulnerable to changes > or deletions made by other software (and is also changing the behavior > of your software), I want to know that I'm pursuing all avenues in the > interest of making sure it never happens again. Replace "your software" with "all software"; in a user-permission based operating system, if you own a file, then applications running as you can change them. An application could delete the file that stores all of your keychain entries without even using the keychain API. It could modify Safari preferences. It could add bookmarks to Camino. It could change the star rankings on the songs in your iTunes library. It could just delete every file in your home folder. The way to protect your data under the assumption that the applications your run are (intentionally or not) out to get you is a real backup solution (like Time Machine). -Stuart _______________________________________________ Camino mailing list Camino@mozdev.org https://www.mozdev.org/mailman/listinfo/camino
