{"record":{"id":"0995fa3c67cdc128","repo":"moonD4rk/HackBrowserData","slug":"keychain-empty-secret-for-s","errorCode":null,"errorMessage":"keychain: empty secret for %s","messagePattern":"keychain: empty secret for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_darwin.go","lineNumber":156,"sourceCode":"\tif err := cmd.Run(); err != nil {\n\t\tif errors.Is(ctx.Err(), context.DeadlineExceeded) {\n\t\t\treturn nil, fmt.Errorf(\"security command timed out after %s\", securityCmdTimeout)\n\t\t}\n\t\t// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;\n\t\t// surface that instead of the cryptic \"exit status 128 ()\".\n\t\tstderrStr := strings.TrimSpace(stderr.String())\n\t\tif stderrStr == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"security command: %w (likely keychain access denied or wrong password)\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"security command: %w (%s)\", err, stderrStr)\n\t}\n\tif stderr.Len() > 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: %s\", strings.TrimSpace(stderr.String()))\n\t}\n\n\tsecret := bytes.TrimSpace(stdout.Bytes())\n\tif len(secret) == 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: empty secret for %s\", storage)\n\t}\n\n\treturn darwinParams.deriveKey(secret), nil\n}\n\n// DefaultRetrievers wires the macOS V10 chain (the only tier Chromium uses here), first success wins:\n//  1. GcoredumpRetriever        — CVE-2025-24204 exploit (root only)\n//  2. KeychainPasswordRetriever — direct unlock, skipped when password is empty\n//  3. SecurityCmdRetriever      — `security` CLI fallback (may prompt)\nfunc DefaultRetrievers(keychainPassword string) Retrievers {\n\tchain := []Retriever{&GcoredumpRetriever{}}\n\tif keychainPassword != \"\" {\n\t\tchain = append(chain, &KeychainPasswordRetriever{Password: keychainPassword})\n\t}\n\tchain = append(chain, &SecurityCmdRetriever{cache: make(map[string]securityResult)})\n\treturn Retrievers{V10: NewChain(chain...)}\n}\n","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L138-L174","documentation":"After `security find-generic-password` succeeds with no stderr, the library reads the printed password from stdout. If stdout is empty (or whitespace only), there is no safe-storage secret to derive the V10 key from, so it fails naming the storage label that had no secret.","triggerScenarios":"`security find-generic-password -wa <storage>` exits 0, prints nothing to stderr, but also no password data — typically when the generic-password item exists but has an empty password attribute, or `-w` matching yields no value.","commonSituations":"Chromium installed but never saved cookies/passwords so Safe Storage was created empty; user deleted the secret body from Keychain Access; a third-party keychain entry with the right label but blank password.","solutions":["Open Keychain Access, find the '<Browser> Safe Storage' item, and confirm its password attribute is non-empty (click 'Show password')","Re-save the secret: use the browser once (visit a site, save a password/cookie) so Chromium repopulates Safe Storage, then retry","Manually create the entry: security add-generic-password -a 'Chrome Safe Storage' -s 'Chrome Safe Storage' -w '<secret>'","Rely on a different tier: supply the login keychain password (KeychainPasswordRetriever) or run as root (GcoredumpRetriever)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"security\", \"find-generic-password\", \"-wa\", \"Chrome Safe Storage\").Output()\nif err == nil && len(bytes.TrimSpace(out)) == 0 {\n    // empty secret — Safe Storage entry has no password; skip this tier\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inspect the '<Browser> Safe Storage' item in Keychain Access and confirm a non-empty password before running extraction","Use the browser at least once on the target profile so Chromium materializes Safe Storage with real data","Recreate the entry with `security add-generic-password` if it was blanked","Configure the full retriever chain so an empty secret falls through to the password/root tiers"],"tags":["macos","keychain","empty-secret","chromium"],"backgroundTag":"empty-required-field","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}