alt Hacker News> Also the OP seemingly implies credentials are stored on-filesystem in plaintext but I might be extrapolating too much there.
Doesn't really matter, if the agent is unlocked they can be accessed.
> Also the OP seemingly implies credentials are stored on-filesystem in plaintext but I might be extrapolating too much there.
Doesn't really matter, if the agent is unlocked they can be accessed.
This is not strictly true - most OS keychain stores have methods of authenticating the requesting application before remitting keys (signatures, non-user-writable paths, etc.), even if its running as the correct user. That said, it requires careful design on the part of the application (and its install process) to not allow a non-elevated application to overwrite some part of the trusted application and get the keys anyway. macOS has the best system here in principle with its bundle signing, but most developer tools are not in bundles so its of limited utility in this circumstance.