2

This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." Why should there be a software on my operating system that deals with my security? The way I do things is keep a spreadsheet in an encrypted file with all my passwords and never tick 'yes' to 'Remember this password?" prompts. Why should OS X compromise me in this way? What is the perspective of a true information security practitioner who knows better than Macintosh?

I've been searching for an answer for a few weeks online but the debates I've come across all attack the unhappy users, without explaining security of Apple's KeyChain Access without partiality. Here is the type of complaint I am referring to.

  • 1
    What are you using to encrypt the spreadsheet? – R15 Nov 10 '15 at 9:36
  • I am using a disk image. – user87589 Nov 15 '15 at 21:22
2

As I understand it, the Keychain is secure. It does employ good Elliptic Curve encryption and handles your data properly. With the caveat that you have to trust Apple. They are handling your data and the encryption, and in some cases transmitting the encrypted data to their servers for cross device syncing etc.

If you want a solution that does not rely on any third party to store or transmit your secure data then you could use a self-managed file like excel, but then you have to be responsible for its encryption, decryption, storage and transmission. There are also a number of offline password managers such as Keepass, which might be easier to manage without needing to trust a third party.

  • Yes: given that I "use a self-managed file like excel" and am "responsible for its encryption, decryption, storage and transmission", how can I please exclude Apple from this process? Thanks for the answer so far - it seems an objective and useful response. – user87589 Nov 10 '15 at 0:09
  • Keepass is still a 3rd party - with less control over the device. – user72066 Nov 10 '15 at 21:38
  • @SourLolita true, but its open source and doesn't transmit or store your data, just encrypts it for you in a manageable format. Unless you are writing your own cryptography you will be trusting some third party software for that. – Hearth Nov 11 '15 at 0:57
  • @OP So what you are really wanting to know is if there is a way to permanently disable the Keychain, not whether it is actually secure to use. I don't believe there is, as it is integrated into the OS and how it handles its own security. – Hearth Nov 11 '15 at 0:59
  • The management of my passwords has become a real concern to me when I found out that Apple used my user password to keep all my other passwords in the keychain. If I knew, I would had bought a book on it to avoid using a serious software so blindly. I have become so amazed at how we use ICT without any sense of responsibility that I have enrolled onto a Linux certification course to have an opportunity of being in control of the system... – user87589 Nov 15 '15 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy