Safari compromises keychain security

moi160 wrote:

Safari's complete history deletion erases keychain passwords in total violation of Apple's security guarantee. The application displays a request for keychain access and systematically deletes the data, even if access is refused.

https://discussions.apple.com/content/attachment/3ab4fb22-358a-4754-867a-bbbc87310c98

This very serious problem was first detected with Safari 17.0 under Ventura 13.6 (Safari 17.0 clear history command deletes… - Apple Community) It still persists with Safari 17.2.1 under Sonoma 14.2.1.

Two security reports have been sent to Apple. The response is edifying: here it is, verbatim:

Thanks for your report. Although we have determined that it doesn’t have security implications that affect our products or services, we appreciate you taking the time to report it to us. If you have additional info that you’d like us to consider, you can include it below, and we’ll let you know if we review the report again.

Apple Product Security

Is apple messing with us?

Alain

I never tried deleting complete history—

my only recommendation don't remove or delete complete history in your Safari browser if it is an issue.

Keychain Access.app stores passwords you can look there

ref: Keychain Access User Guide for Mac

Call Customer Support (800) MY–APPLE (800–692–7753)

or on line https://getsupport.apple.com/

Outside the USA—Contact Apple for support and service by phone

See a list of Apple phone numbers around the world.

Contact Apple for support and service - Apple Support

Communauté d’assistance Apple officielle

Apple Support Communities - French