2

This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." Why should there be a software on my operating system that deals with my security? The way I do things is keep a spreadsheet in an encrypted file with all my passwords and never tick 'yes' to 'Remember this password?" prompts. Why should OS X compromise me in this way? What is the perspective of a true information security practitioner who knows better than Apple?

I've been searching for an answer for a few weeks online but the debates I've come across all attack the unhappy users, without explaining security of Apple's KeyChain Access without partiality. Here is the type of complaint I am referring to.

2
  • 1
    What are you using to encrypt the spreadsheet?
    – R15
    Commented Nov 10, 2015 at 9:36
  • I am using a disk image.
    – user87589
    Commented Nov 15, 2015 at 21:22

1 Answer 1

2

As I understand it, the Keychain is secure. It does employ good Elliptic Curve encryption and handles your data properly. With the caveat that you have to trust Apple. They are handling your data and the encryption, and in some cases transmitting the encrypted data to their servers for cross device syncing etc.

If you want a solution that does not rely on any third party to store or transmit your secure data then you could use a self-managed file like excel, but then you have to be responsible for its encryption, decryption, storage and transmission. There are also a number of offline password managers such as Keepass, which might be easier to manage without needing to trust a third party.

5
  • Yes: given that I "use a self-managed file like excel" and am "responsible for its encryption, decryption, storage and transmission", how can I please exclude Apple from this process? Thanks for the answer so far - it seems an objective and useful response.
    – user87589
    Commented Nov 10, 2015 at 0:09
  • Keepass is still a 3rd party - with less control over the device.
    – user72066
    Commented Nov 10, 2015 at 21:38
  • @SourLolita true, but its open source and doesn't transmit or store your data, just encrypts it for you in a manageable format. Unless you are writing your own cryptography you will be trusting some third party software for that.
    – Hearth
    Commented Nov 11, 2015 at 0:57
  • @OP So what you are really wanting to know is if there is a way to permanently disable the Keychain, not whether it is actually secure to use. I don't believe there is, as it is integrated into the OS and how it handles its own security.
    – Hearth
    Commented Nov 11, 2015 at 0:59
  • The management of my passwords has become a real concern to me when I found out that Apple used my user password to keep all my other passwords in the keychain. If I knew, I would had bought a book on it to avoid using a serious software so blindly. I have become so amazed at how we use ICT without any sense of responsibility that I have enrolled onto a Linux certification course to have an opportunity of being in control of the system...
    – user87589
    Commented Nov 15, 2015 at 21:27

You must log in to answer this question.