Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

From	Your Name <YourName@YourISP.com>
Newsgroups	comp.sys.mac.misc
Subject	Re: Is Keychain or any other program safe for storing sensitive data on a desktop Mac?
Date	2018-11-19 14:38 +1300
Organization	Aioe.org NNTP Server
Message-ID	<pst475$5l5$1@gioia.aioe.org> (permalink)
References	(5 earlier) <2018111519365359151-tomevans9890@yahoo.ca> <psllch$flq$3@gioia.aioe.org> <2018111608153881377-tomevans9890@yahoo.ca> <psnaad$1ajn$1@gioia.aioe.org> <2018111814311074007-tomevans9890@yahoo.ca>
Show all headers | View raw
On 2018-11-18 22:31:10 +0000, Tom Evans said:
> On 2018-11-16 20:46:07 +0000, Your Name said:
>> On 2018-11-16 16:15:38 +0000, Tom Evans said:
>>> On 2018-11-16 05:42:41 +0000, Your Name said:
>>>> On 2018-11-16 03:36:53 +0000, Tom Evans said:
>>>>> On 2018-11-16 01:14:44 +0000, Your Name said:
>>>>>> On 2018-11-15 20:25:50 +0000, Tom Evans said:
>>>>>>> On 2018-11-13 01:00:32 +0000, Your Name said:
>>>>>>>> On 2018-11-12 21:34:27 +0000, Tom Evans said:
>>>>>>>>> On 2018-11-11 05:09:38 +0000, Your Name said:
>>>>>>>>>> On 2018-11-11 03:56:30 +0000, Tom Evans said:
>>>>>>>>>>> 
>>>>>>>>>>> Thanks, John and Your. Do you recommend Ipassword over Keychain?
>>>>>>>>>> 
>>>>>>>>>> They completely diffent apps for dsifferent purposes.
>>>>>>>>>> 
>>>>>>>>>> Keychain utility isn't meant to be a user-friendly password manager for 
>>>>>>>>>> looking up passwords, adding new passwords, etc. Keychain is meant to 
>>>>>>>>>> be used along-side auto-form filling as an automatic process, and the 
>>>>>>>>>> utility is only there to allow you to delete old passwords and change 
>>>>>>>>>> passwords.
>>>>>>>>>> 
>>>>>>>>>> 1Password and other similar apps are proper password managers (and in 
>>>>>>>>>> some cases like 1Password they can store other things as well, such as 
>>>>>>>>>> software license codes). They are much easier to use.
>>>>>>>>> 
>>>>>>>>> In that case it seems that Ipassword would be more appropriate for me 
>>>>>>>>> because it's easier to use than Keychain.
>>>>>>>>> 
>>>>>>>>> As I wrote, I want to keep an anlphabetical list of information about 
>>>>>>>>> the companies I deal with (such as Amazon, Apple, Best Buy, Costco, 
>>>>>>>>> etcetera) and then have particular notes about those companies (such as 
>>>>>>>>> serial numbers; coupon codes; customer service URL if it's hard to find 
>>>>>>>>> on the companies' Net sites; notes about the Web site forum if it has 
>>>>>>>>> one and if I'm a memberr of that forum;, and security question and 
>>>>>>>>> answers for Web sites if that's applicable.  And as I wrote I want to 
>>>>>>>>> be able to control type characteristics, such as font, font size and 
>>>>>>>>> font bolding in my alphabetical, searchable list of company notes.  I 
>>>>>>>>> also would want the ability to print the list of notes while 
>>>>>>>>> maintaining the text characteristics.
>>>>>>>> 
>>>>>>>> 1Password can store all sorts of things, but the Notes box in each 
>>>>>>>> entry can't be formatted (it's just plain text) ... or at least it is 
>>>>>>>> in version 6, I haven't got version 7 yet. I'm still trying to decide 
>>>>>>>> about their changeover to silly subscriptions (upgrading from version 6 
>>>>>>>> does mean I can get a license for verison 7, but we don't know about 
>>>>>>>> versions after that) or just swapping to one of the other 'normal' apps.
>>>>>>>> 
>>>>>>>> It can print entries, but you don't have any control over the layout. 
>>>>>>>> It can also export the entries to a plain text file which you could 
>>>>>>>> then format in any word processor. Both printing and exporting kind of 
>>>>>>>> defeats the main purpose of having a secure password manager though. 
>>>>>>>> You may as well just use a text file or Word / Pages document.
>>>>>>> 
>>>>>>> I dont think that's true, because my computer seems to be more 
>>>>>>> susceptible to hacking than physical attack.
>>>>>>> 
>>>>>>> There's not much at risk of a physical attack of my premises.
>>>>>>> 
>>>>>>> My security breach that just happened wasn't perpetrated by a physical 
>>>>>>> intruder.
>>>>>>> 
>>>>>>> It's very unlikely that a thief would have found my bank data 
>>>>>>> (including written questions and answers to my security questions and 
>>>>>>> other information such as the dates of my bank transactions and how 
>>>>>>> many accounts I have and perphaps PINs) by going through my garbage, so 
>>>>>>> a hack either of my computer -- or one of the bussinesses that I deal 
>>>>>>> with --  is I think the mose likely cause.
>>>>>> 
>>>>>> The "security breach that just happened", assuming it had anything at 
>>>>>> all to do with computers, is most likely caused by you entering the 
>>>>>> password into a fake phishing webpage. There's basically nothing any 
>>>>>> piece of software can do about that ... they can block *known* phishing 
>>>>>> websites, but they'll never be able to block them all since hundreds of 
>>>>>> new ones spring up daily. You instead have to use some common sense and 
>>>>>> never click on links simply because they tell you to.
>>>>> 
>>>>> As I already explained twice, the only emails I clicked on led to pages 
>>>>> where I pressed the "Unsubscribe" link and typed my email addres and 
>>>>> pressed the return key.  THAT'S ALL I TYPED THERE.
>>>> 
>>>> That was only one potential example.
>>> 
>>> What are the other examples?
>> 
>> We've already given a few - fake 'bank' webpages, dodgy competition 
>> entry forms, scam "help desk" phone calls, etc., etc. There are far too 
>> many potential possibilities to completely list, and you'd never know 
>> which was the culprit anyway ... even assuming it was any of them at 
>> all.
> 
> I only access my bank's Web site from my Google bookmarks.
> 
> I've never entered Net-based competitions and telemarketers with their 
> irritating offers of credit cards.
> 
> I also don't think I've ever had 'help desk' phone calls from 
> companies, unless it was involving companies that I deal with, such as 
> my phone service provider.  And if I got any such calls, those calls 
> would only have been received soon after I phoned the companies' phone 
> numbers and then they called back soon after my calls to deal with the 
> issues I reported.
> 
> So I'm pretty sure I can rule out any and all of those possibilities -- 
> both form the recent and distant past.
> 
> Thanks, Your!

Yet another of the infinite possibilities is if you've taken the Mac to 
be repaired. A scumbag (usually not Apple Authorised) repair centre 
could install some sort of app, malware or legitimate, that gives them 
access to the computer ... or they could simply have read the file 
saved on your computer while they had it in the shop.
Thread

csiph-web