First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest session to access my keychain.
Knowing this, I will rewrite the opening line to the article.
Original line: "Here’s a reason why you shouldn’t let anyone use your computer."
My revised line: "Here's a reason why you shouldn't let [untrusted persons] use [a non-guest session on] your computer."
What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?
Some web sites will require you to login again if your IP address changes, no matter what cookies you have. Additionally, the cookie expires. For these websites, the password is much better.
shadowflit made a good point about two-factor authentication. I would also add that by having cookies (and hence a presumed established session with you bank, email provider, or social network) you bypass one of the steps to get what you presumably want: access. I mean to point out that there is no reason to run this script if you already have physical access to a computer with the target's account logged on. You already have the extra access you need.
Comments
First of all, if someone has unauthorized physical access to your device, you're pretty hosed. Especially if they happen to have a current logged in session. Forget passwords, they have cookies and mail.app and bookmarks. Second, if you must lend your computer to an untrusted person, use the Guest session. I just tried this and confirmed that there is no immediately obvious way for a person logged in to a guest session to access my keychain.
Knowing this, I will rewrite the opening line to the article.
Original line: "Here’s a reason why you shouldn’t let anyone use your computer."
My revised line: "Here's a reason why you shouldn't let [untrusted persons] use [a non-guest session on] your computer."
What do you mean "Forget passwords, they have cookies..."? Since when is having a cookie better than having the password that can give you the cookie anyway?
If you have two factor authentication but leave yourself signed in, a password alone will not get an intruder into your account, but a cookie will.
Some web sites will require you to login again if your IP address changes, no matter what cookies you have. Additionally, the cookie expires. For these websites, the password is much better.
shadowflit made a good point about two-factor authentication. I would also add that by having cookies (and hence a presumed established session with you bank, email provider, or social network) you bypass one of the steps to get what you presumably want: access. I mean to point out that there is no reason to run this script if you already have physical access to a computer with the target's account logged on. You already have the extra access you need.