- Secure Your Mac OS X System Now!
- Keychain: Are You the Keymaster?
- More Security with More Account Options
- Know Your Services and Configure Them All Securely
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Keychain: Are You the Keymaster?
The Keychain is the sum total of all your password security, across many of your applications. You must understand how it works and keep it secure.
Password caching and synchronization agents can be risky. Whether through trojanized applications or through JavaScript that executes in your user session, many password caching agents are raided for their stored passwords. Should you use these agents?
The Keychain is a great help, and even third-party applications written for Mac OS X will use the Keychain. Let's explore specific Keychain security settings.
If you open the Keychain Access.app, located in Application Utilities, you can set the preferences (see Figure 1). By enabling “Synchronize login keychain password with account,” you can make Keychain integration with your login session effortless: Your Keychain master password will be your account password. Setting the login keychain as default binds Keychain action to your login session, with seamless integration.
)
Figure 1 Setting Keychain's preferences
Let's continue with another important security setting: locking the Keychain when it's not in use. But before that, click the General tab and select Show Keychain Status in Menu Bar. Why? I'll explain later. Back to locking the Keychain.
Delayed attacks that raid cached passwords are common. One way to prevent this is enabling Keychain locking. Lock the Keychain during system Sleep or periods of inactivity.
Highlight the login keychain and review the Edit menu options:
- Change Settings for Keychain “login.”
- Change Password for Keychain “login.”
Figure 2 allows you to set the locking settings. You can even ensure your settings carry onto your other Apple devices, through MobileMe Synchronization and with the new iCloud features.
)
Figure 2 Locking the Keychain
What have we accomplished? Whether I put the computer in sleep mode or the system is inactive, the Keychain locks up. Any request to smuggle new passwords into the Keychain, to get current passwords, or to add new password/account pairings into the Keychain fail until I type in my Keychain/login password.
This also means I should expect to see more prompts from Keychain. If I want to, I can use the second option and change the login keychain password. Maybe I want to lock Keychain with a super-duper password? Maybe my account's password was reset without using the “Users and Groups” applet in the System Preferences? In this case, if I want to restore account-password-to-Keychain-password integration, I need to reset the login keychain's password to my new account password value.
Review your Keychain security plan carefully. Stay with the default setting, and you keep the passwords safe when you step away from your system. If you lock up the Keychain, you will get login prompts each time you (or someone else) need to fetch, add, or update a password. The extra security may be worthwhile and compensate for any inconvenience.
And now for this article's woot. Go to your menu bar, now that you've set the Keychain preference as I asked you to do. Figure 3 shows you now have an easy way to lock your screen AND lock or unlock the Keychain.
)
Figure 3 Keychain Preference setting improves security