About Mac OS X Keychain Security

The Mac OS X Keychain (or just "keychain" hereon), is essentially a password manager. You can add items, usually encryption keys or passwords, to the keychain. Applications that need a key or a password can then look on the keychain for that keychain item. Normally, the keychain is locked, so anytime an application asks for a password, if the keychain is locked, the keychain has to ask you, the owner of the keychain, to unlock it. In its default configuration, however, the keychain uses the same password as your account login password (you can change it). At login, your keychain is then automatically unlocked (because it uses the same password as your login). This means that anyone who uses your computer can use any of your passwords on the keychain.

To make your keychain more secure, you should probably configure it at least to lock whenever your screensaver activates or your laptop goes to sleep. You should also make sure your keychain password is secure – any password or encryption key stored on the keychain is only as secure as the password you use. You can change these settings by using the /Applications/Utilities/Keychain Access application. Just select Edit -> Change settings for keychain "name". I keep mine set to lock when sleeping, and I have my screensaver set to require a password to unlock.

Last modified 21 January 2004 at 5:09 pm by eaganj