TweetFollow Us on Twitter

All Keyed Up

Volume Number: 21
Issue Number: 10
Column Tag: Programming

All Keyed Up

Up Close and Personal With the Keychain: A First Look

by Ilene Hoffman

Our Own Little Corner of the Directory

As your car and house keys provide you access to your stuff behind closed doors, so does the keychain in Mac OS X. A keychain is Apple's designation for a file used to store your passwords, i.e. it is a container for changeable data, where you "write" passwords and save them in a secure file format. These are passwords you created to access software, instant message accounts, mail accounts, web sites, remote servers, such as AppleShare servers, database servers plus other types of personal information you don't want to forget. When a keychain is unlocked, you no longer have to remember or even type in a requested password for any item you've stored in a keychain. You can create as many different keychains as you like and can name them to differentiate the content, according to your personal preferences. The items in a keychain are keys that encrypt or decrypt data. Each keychain can hold as many passwords or keys as needed.

Unless you're some flavor of system or network administrator or your significant other has broken into your coveted system, the keychain is of little concern to you - it just works. In fact, the most common question received from my small business clients is: How do I turn off the keychain? Before you jump the gun and disable this too often maligned system utility, let's take a closer look at its use, functions, and benefits. Remember it is the only place Apple gives you to securely store all your private information.

When you start-up and log-in to with your own password Mac OS X your preferences, customized environment and your keychains are loaded. The main or default keychain, named login, is unlocked automatically. If you set up a .Mac email account when you set up your machine, that password is also stored in the login keychain. Any passwords you add to that keychain are available to you when you log in, so you should be careful if you leave your machine unattended in a populated environment. This is because your passwords are available to any stored item. Logging out of your user account locks the keychain or, if you prefer, you can set Automatic Locking, which is discussed below. For enhanced protection you can change your login keychain password, so that it is not unlocked at startup.


Figure 1. Accessing password-protected services using a keychain

(Source: Enabling Secure Storage With Keychain Services, (c) 2004 Apple Computer, Inc., page 10.)

Keychain Access

The application Keychain Access, found inside the Utilities folder inside your Applications folder, is used to add, delete, and edit keys and keychains. You can also create new keychains, change the default keychain, or troubleshoot keychains. When you first open the application, you see your login keychain with a list of all of its stored passwords, a toolbar, and buttons to view each password key's attributes and access control.

When you first launch Keychain Access you see the login keychain with each of the default keys already entered. Any email address you entered when you set up Mac OS X is entered into the login keychain. In Figure 2, you can see an Earthlink address is active. The toolbar contains buttons to add a new Password, create a Note, Delete a key, Go to a web site, and Lock (or Unlock) the whole Keychain. Click Show Keychains to open a drawer to view all your keychains. The drawer has a nice feature where, if you can run your mouse over the name and location, the path to the keychain appears.


Figure 2. Keychain Acess Window

Each key includes a name , the kind of password, and its creation and modification date in a list view, as seen in Figure 2. When you choose an item (click once) the Delete button activates, so removing a key is easy. A dialog appears with a Delete button to confirm the action. Any item that contains the @ sign signifies that a web-related application is opened when you select the key and press the Go button. Applications include web browsers, email, and ftp applications.

Use the Attributes and Access Control buttons to view more information or edit a key. As seen in Figure 3 below, under the Attributes button you can change or edit any of the items, although some items add information automatically which is useful, such as the Comments for Safari's Forms Autofill utility. Generally, editing these items is not encouraged. A checkbox to Show Password is helpful, but leaving it unchecked is recommended. If you prefer to paste in your password manually, click the Copy Password to Clipboard button. If you do change any information, don't forget to Save Changes. The Comments area is especially useful as it allows you want to make notes on an account.


Figure 3. Attributes in Keychain Acess Window

Access Control is one of the areas that allow you control over when you are prompted for your password(s). As I tell my clients, if you don't want to be bothered with password dialogs, check Access Control to make sure the radio button Allow all applications to access this item is selected. If you want a more secure system, select Confirm before allowing access, so that applications will request your input, and, for an additional layer of security, add the checkbox Ask for Keychain password. You can also use the`Add button and exempt some applications from requesting a password. When you change the permissions for any item, you must Confirm Access to Keychain and type in your Keychain password. Figure 4 shows a Safari Forms AutoFill key that requires a confirmation before any application other than Safari can access the stored information. Remember that the Finder is just another application in Mac OS X.


Figure 4. Access Control in Keychain Acess Window

Create and Use New Keychains

If you think about it, it makes more sense in an environment where a lot of other people are running around to have at least one other keychain that isn't opened automatically when you boot up. So, just how do you create those secondary keychains? Keychain Access, of course! The steps are simply: Launch Keychain Access, choose New Keychain from the File menu, name the keychain, choose where to save it, and click Create. You will be asked to enter and verify a password for that new keychain. If you don't specify saving the keychain in another location, it is stored by default as the follows: (~/Library/Keychains). After you click Create you choose a password for the keychain and that's it, or is it?

Hidden Cool Resources

There are some very useful resources tucked away behind some innocuous buttons in the New Keychain Password dialog. The blue Details button shows information on the location of your new keychain, plus the application associated with it (in this case, Keychain Access.app). Details appear in a number of the dialogs in Keychain Access. The question mark button in the Password dialog takes you to a Mac Help screen on how to choose good passwords.


Figure 5. The New Keychain Password Dialog with the Open Password Assistant

An even better resource is the Password Assistant. Click on the i button and the Assistant rates the quality of your password. In Figure 5, you can see that when I type my own name as the password it returns a low quality(6.5) because the password is not only too short, but very easy to guess. In fact, because it is under six characters , Mac OS X won't let me use my name as the password. When you've chosen a good password, the quality rating goes as high as 10% and the bar turns from red to green. As one network administrator friend of mine commented upon first seeing this help screen: "Wow, this is really helpful."

Multiple Keychains

To view all your keychains you can either select Show Keychains from the toolbar, which opens a Keychain drawer, or choose Show Keychains from the View menu, the keyboard short cut is command-shift- K.

You can also add a previously created keychain to your keychain list, even if the keychain was created on a different machine. To do this first move the keychain file to your computer and store it in your home directory ( ~/Library/Keychains). Second, open Keychain Access and choose Add Keychain... from the File menu. In the Open dialog navigate to the desired keychain and click Open. The keychain is now listed in the Keychain list.

Securing the Secure: Keychain Security

To help secure your machine, you can set each keychain lock preference separately. As noted above this helps protect prying eyes from accessing your information by mistake. You can lock your keychain manually, set it to lock after a specified amount of time or require applications to request access, as stated above. To make changes open Keychain Access, click on the keychain you want to change in the Keychains drawer, and choose Change Settings for Keychain from the Edit menu. The prompt to unlock your keychain appears, and after you type your password, the Change Keychain Settings dialog comes up.


Figure 6. Change Keychain Settings

As can be seen in Figure 6, check boxes make setting locking preferences easy. You can set a keychain to lock after any number of idle minutes and/ or you can Lock a keychain when your machine goes to sleep.

Remember that you can also change settings for a specific key in the Access Control pane, as detailed in the Keychain Access section above.

NOTE: If you find you need to access your keychains often, you can display an icon in your menu bar to open Keychain Access and have immediate access to work with your keys. In Keychain Access, choose Show Status in Menu Bar from the View menu, and a lock icon appears in your menu bar.

Adding New Keys

You can add keys in one of two ways:

1. When you launch a password protected item, such as your FTP site from an FTP app such as Fetch, Transit, Anarchie, you may be prompted to save your password in a keychain. A checkbox labeled: Add to Keychain is built into some applications. Click the box and your key is automatically added to your login.keychain. (Note: An incorrect item can be added, so please check your Keychain if you press the OK button and discover that you've made a mistake.) Whether a password can be added from an open dialog is totally up to the program's developer. As you can see in Figure 7, AOL Instant Messenger prompts you to save your password in a keychain, as does iChat.


Figure 7. AOL Dialog within iChat with Keychain Access Checkbox

2. The second way to add a key is to open Keychain Access and click the Password button. The New Password Item dialog appears and you can manually type in all the information to access any password-protected account you own, as you can see in Figure8. A side note to info I find useful: These passwords do not have to be computer related, you can save bank account information, your bike lock, or your account and PIN numbers for all those credit cards you own. Remember, when you click the Show Typing checkbox you can see your actual password. When an application or item is not supported by Keychain Access, these password items work perfectly as a repository to save secret items. Again, it is a good idea to save these items in a keychain other than the login.keychain (it works better and is more secure than having sticky notes stuck all over your computer). Just remember to click on the keychain you'd like to use before you create your new key.


Figure 8. New Password Dialog

Keychain Repair: First Aid

If you find things aren't working as expected, Keychain First Aid, available from the Window menu of Keychain Access, helps you troubleshoot your keychain problems. The main window contains three useful buttons, Verify checks passwords, settings, and the contents of your keychains. The Repair radio button fixes any problems found in your keychains. The third Options button contains settings.


Figure 9. Keychain First Aid

Under the General Options you can clear previous logs created when you run Verify and Repair. In the unlikely event you've experienced keychain corruption, you can also Reset your selected keychain so that you can start over again. As stated in the dialog, your original keychain is moved, but not deleted.

The Expert Options allows you to set your login.keychain as the default and synchronize it when logging in. Best of all, for all those users who complain about the constant user password prompts, you can set your login keychain to remain unlocked, always!

Conclusion

As you've seen, Keychain Access is designed to protect your personal information, while providing you easy access to password protected items. Apple's Keychain Access Help is comprehensive and should be the first line place you turn when you have a question. If you want more technical information on security in Mac OS X or keychains, Apple's site has a number of informative documents:

Developer Resources


Ilene Hoffman, MS is a Macintosh/ Internet Consultant. She stole her first Mac from her Dad in 1984 after asking him to buy a PC. She's worked for a bunch of major Mac sites, written for many Mac-based publications, and regularly provides troubleshooting expertise to small businesses. Ilene and her dog can be found in the Boston area under a pile of really old Macs.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Apple Remote Desktop 3.9 - Remotely cont...
Apple Remote Desktop is the best way to manage the Mac computers on your network. Distribute software, provide real-time online help to end users, create detailed software and hardware reports, and... Read more
SoftRAID 5.5.6 - High-quality RAID manag...
SoftRAID allows you to create and manage disk arrays to increase performance and reliability. SoftRAID allows the user to create and manage RAID 4 and 5 volumes, RAID 1+0, and RAID 1 (Mirror) and... Read more
Apple Final Cut Pro X 10.3.2 - Professio...
Apple Final Cut Pro X is a professional video editing solution.Completely redesigned from the ground up, Final Cut Pro adds extraordinary speed, quality, and flexibility to every part of the post-... Read more
Logic Pro X 10.3.1 - Music creation and...
Logic Pro X is the most advanced version of Logic ever. Sophisticated new tools for professional songwriting, editing, and mixing are built around a modern interface that's designed to get creative... Read more
Paragraphs 1.1.4 - Writing tool just for...
Paragraphs is an app just for writers. It was built for one thing and one thing only: writing. It gives you everything you need to create brilliant prose and does away with the rest. Features... Read more
VueScan 9.5.70 - Scanner software with a...
VueScan is a scanning program that works with most high-quality flatbed and film scanners to produce scans that have excellent color fidelity and color balance. VueScan is easy to use, and has... Read more
TextSoap 8.3.2 - Automate tedious text d...
TextSoap can automatically remove unwanted characters, fix up messed up carriage returns, and do pretty much anything else that we can think of to text. Save time and effort. Be more productive. Stop... Read more
ForkLift 3.0 - Powerful file manager: FT...
ForkLift is a powerful file manager and ferociously fast FTP client clothed in a clean and versatile UI that offers the combination of absolute simplicity and raw power expected from a well-executed... Read more
Amazon Chime 4.0.5528 - Amazon-based com...
Amazon Chime is a communications service that transforms online meetings with a secure, easy-to-use application that you can trust. Amazon Chime works seamlessly across your devices so that you can... Read more
Sparkle 2.1.0 - $79.99
Sparkle will change your mind if you thought building websites wasn't for you. Sparkle is the intuitive site builder that lets you create sites for your online portfolio, team or band pages, or... Read more

Blasty Bubs is a colorful Pinball and Br...
QuickByte Games has another arcade treat in the works -- this time it's a mishmash of brick breaking and Pinball mechanics. It's called Blasty Bubs, and it's a top down brickbreaker that has you slinging balls around a board. [Read more] | Read more »
Corsola and Heracross are the new region...
Generation 2 finally launched in Pokémon GO, unleashing a brand new batch of Pokémon into the wild. Even before the update went live people were speculating on how to catch elusive Pokémon like the legendary "dogs", Unknown, and whether or not... | Read more »
The Warlock of Firetop Mountain (Games)
The Warlock of Firetop Mountain 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: An epic adventure through a mysterious mountain filled with monsters, magic and mayhem! “...it looks downright... | Read more »
Fantasy MMORPG MU Origin’s receives a hu...
Developer Webzen are looking to take their highly popular fantasy battler MU Origin to the next level this month, with its most ambitious overhaul yet. The latest update introduces the long sought after Server Arena, new treasure dungeons, and much... | Read more »
RPG Djinn Caster (Games)
RPG Djinn Caster 1.0.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.0 (iTunes) Description: SPECIAL PRICE 38% OFF(USD 7.99 -> USD 4.99)!!!A Fantasy Action RPG of far foreign lands! Summon the Djinns and rise to... | Read more »
Alto's Odyssey gets its first trail...
There's finally video evidence of Alto's Odyssey, the follow up to the 2015 App Store hit, Alto's Adventure. It looks just as soothing and atmospheric as Alto's last outing, but this time players will be journeying to the desert. Whereas Alto's... | Read more »
Last week on Pocket Gamer
What’s going on in the wider world of portable gaming? Each week we ask that question of our sister website Pocket Gamer. The PG team covers iOS gaming, just like 148Apps, but it also strays into the world of Android games and handheld consoles... | Read more »
Pokémon GO Generation 2 evolution guide
At long last, Niantic Labs finally unleashed the Generation 2 Pokémon into the wild. Pokémon GO trainers are scrambling to grab up this new set of 80 Pokémon. There are some special new tricks required to catch all of these new beasties, though.... | Read more »
The best new games we played this week
It feels as though the New Year got off to a creaking start as far as mobile games go, but that's changed over the past few weeks. The last few days alone have seen the debut of a number of wonderful games, so we thought we'd take the time to... | Read more »
Recruit more scallywags and discover new...
Get ready to show off your sea legs all over again in Oceans & Empires’ new grand update, which aims to make the act of rising to the role of seven seas ruler even more fresh and appealing, thanks to a richness of new content on both iOS and... | Read more »

Price Scanner via MacPrices.net

QuickerTek Announces 5TB Apple AC AirPort Tim...
QuickerTek Inc. has announced their new 5TB hard drive upgrade for Apple’s AC AirPort Time Capsule. By customer request, this upgrade also features six external antennas and offers the highest... Read more
Apple Certified Refurbished iMacs available f...
Apple has Certified Refurbished 2015 21″ & 27″ iMacs available for up to $350 off MSRP. Apple’s one-year warranty is standard, and shipping is free. The following models are available: - 21″ 3.... Read more
Apple offering Certified Refurbished Series 1...
Apple is now offering Certified Refurbished Series 1 and Series 2 Apple Watches for 14-16% off MSRP, starting at $229. An Apple one-year warranty is included with each watch. Shipping is free: Series... Read more
1.4GHz Mac mini on sale for $449, save $50
B&H Photo has the 1.4GHz Mac mini on sale for $50 off MSRP including free shipping plus NY sales tax only: - 1.4GHz Mac mini: $449 $50 off MSRP Read more
12-inch Retina MacBooks on sale for $200-$250...
Newegg has the 12″ 1.2GHz Space Gray Retina MacBook (sku MLH82LL/A) on sale for $1349.99 including free shipping. Their price is $250 off MSRP, and it’s the lowest price available for this model.... Read more
13-inch 2.0GHz Space Gray MacBook Pro on sale...
Adorama has the non-Touch Bar 13″ 2.0GHz Space Gray MacBook Pro in stock today for $100 off MSRP. Shipping is free, and Adorama charges NY & NJ sales tax only: - 13″ 2.0GHz MacBook Pro Space Gray... Read more
13-inch Touch Bar MacBook Pros on sale for $1...
B&H Photo has select 2016 Apple 13″ Touch Bar MacBook Pros in stock today and up to $100 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 2.9GHz/512GB Touch Bar MacBook... Read more
KSI-1802R SX Disinfect-able Keyboard With Wav...
KSI has unveiled a new, innovative medical keyboard, the KSI-1802R SX, at HIMSS 2017, running February 19-22 in Orlando, Florida. KSI-1802R SX is the only keyboard that combines dual factor... Read more
15-inch Touch Bar MacBook Pros on sale for up...
Amazon has 15″ Touch Bar MacBook Pros in stock today and on sale for up to $150 off MSRP including free shipping: - 15″ 2.7GHz Touch Bar MacBook Pro Space Gray: $2720.38 $79 off MSRP - 15″ 2.7GHz... Read more
Apple’s Education discount saves up to $300 o...
Purchase a new Mac or iPad using Apple’s Education Store and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free: -... Read more

Jobs Board

*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Manager *Apple* Systems Administration - Pu...
Req ID 3315BR Position Title Manager, Apple Systems Administration Job Description The Manager of Apple Systems Administration oversees the administration and Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Manager *Apple* Systems Administration - Pu...
Req ID 3315BR Position Title Manager, Apple Systems Administration Job Description The Manager of Apple Systems Administration oversees the administration and Read more
*Apple* Technician - nfrastructure (United S...
Let’s Work Together Apple Technician This position is based in Portland, ME Life at nfrastructure At nfrastructure, we understand that our success results from our Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.