diff --git a/svncommands.py b/svncommands.py
index 2f57842261..08a84e6234 100644
--- a/svncommands.py
+++ b/svncommands.py
@@ -19,8 +19,7 @@ def incoming(ui, svn_url, hg_repo_path, skipto_rev=0, stupid=None,
     svn_url = util.normalize_url(svn_url)
 
     initializing_repo = False
-    user = opts.get('username', hgutil.getuser())
-    passwd = opts.get('password', '')
+    user, passwd = util.getuserpass(opts)
     svn = svnwrap.SubversionRepo(svn_url, user, passwd)
     author_host = "@%s" % svn.uuid
     tag_locations = tag_locations.split(',')
@@ -68,8 +67,7 @@ def rebuildmeta(ui, repo, hg_repo_path, args, **opts):
         raise hgutil.Abort('You must pass the svn URI used to create this repo.')
     uuid = None
     url = args[0].rstrip('/')
-    user = opts.get('username', hgutil.getuser())
-    passwd = opts.get('password', '')
+    user, passwd = util.getuserpass(opts)
     svn = svnwrap.SubversionRepo(url, user, passwd)
     subdir = svn.subdir
     svnmetadir = os.path.join(repo.path, 'svn')
diff --git a/util.py b/util.py
index c75996785b..ef63ed4b31 100644
--- a/util.py
+++ b/util.py
@@ -6,6 +6,14 @@ from mercurial import node
 from mercurial import util as hgutil
 
 
+def getuserpass(opts):
+    # DO NOT default the user to hg's getuser(). If you provide
+    # *any* default username to Subversion, it won't use any remembered
+    # username for the desired realm, breaking OS X Keychain support,
+    # GNOME keyring support, and all similar tools.
+    return opts.get('username', None), opts.get('password', '')
+
+
 def version(ui):
     """Guess the version of hgsubversion.
     """
diff --git a/utility_commands.py b/utility_commands.py
index f5e69df161..7a972a9786 100644
--- a/utility_commands.py
+++ b/utility_commands.py
@@ -36,8 +36,7 @@ def genignore(ui, repo, hg_repo_path, force=False, **opts):
     url = hge.url
     if url[-1] == '/':
         url = url[:-1]
-    user = opts.get('username', hgutil.getuser())
-    passwd = opts.get('passwd', '')
+    user, passwd = util.getuserpass(opts)
     svn = svnwrap.SubversionRepo(url, user, passwd)
     dirs = [''] + [d[0] for d in svn.list_files(branchpath, r) if d[1] == 'd']
     for dir in dirs:
diff --git a/wrappers.py b/wrappers.py
index 9ecef16d1b..6eb4e11e20 100644
--- a/wrappers.py
+++ b/wrappers.py
@@ -98,9 +98,7 @@ def push(orig, ui, repo, dest=None, *args, **opts):
         raise hgutil.Abort('wrong subversion url!')
     svn_commit_hashes = dict(zip(hge.revmap.itervalues(),
                                  hge.revmap.iterkeys()))
-    user = opts.get('username', hgutil.getuser())
-    passwd = opts.get('password', '')
-
+    user, passwd = util.getuserpass(opts)
     # Strategy:
     # 1. Find all outgoing commits from this head
     if len(repo.parents()) != 1:
@@ -250,8 +248,7 @@ def pull(orig, ui, repo, source="default", *args, **opts):
                   ' of SWIG.\n')
         have_replay = False
     initializing_repo = False
-    user = opts.get('username', hgutil.getuser())
-    passwd = opts.get('password', '')
+    user, passwd = util.getuserpass(opts)
     svn = svnwrap.SubversionRepo(svn_url, user, passwd)
     author_host = "@%s" % svn.uuid
     tag_locations = ['tags', ]