MacOS – How to prevent passwords from being saved to the keychain

keychainmacospassword

Whenever I use the SVN command-line client on my Mac, it stores the password to os keychains without my permission.

While the immediate issue is with the SVN command-line client, the scope of this question is more general.

There are very few situations in which I want a password to reside anyplace either than (a) my head, or (b) an encrypted DMG whose password is saved only in my head.

Once this unauthorized password capture has been made, then every single time I access that repository via Subclipse, Keychain butts in, asking me (if I remember right) to deny once, allow once, or allow indefinitely, BEFORE I can reach the Sublclipse sign-on dialog. To prevent this, I have to go into Keychain Access, and delete the record — which then reappears as soon as I use the command-line SVN client. Thus, Keychain defeats its whole purpose of "convenience."

How do I prevent this unauthorized capture and storage? An answer specific to the SVN command-line client would be good; a more general answer would be better.

Best Answer

I have managed to find an SVN-specific answer.

It seems that the SVN client itself uses whatever password caching functionality is available on the underlying platform, but this can be controlled with a configuration file.

Specifically, configuration files for SVN can be found on a Mac or *nix box in the "invisible" directory ~/.subversion (i.e., ".subversion" within your home directory). In the current release, to unconditionally suppress all password caching, go to %/.subversion, and edit the "servers" file in the editor of your choice. Find the [global] section, and within it, the commented-out line,

# store-passwords = no

Remove the pound-sign and the leading space (if you leave the leading space in, the svn client will fail -- I learned this the hard way). The line should now read

store-passwords = no

And that will unconditionally suppress password caching in the Eclipse client.