Groups > comp.sys.mac.misc > #6717 > unrolled thread

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Started by	Tom Evans <tomevans9890@yahoo.ca>
First post	2018-11-07 21:59 -0800
Last post	2018-11-08 20:22 +0000
Articles	11 on this page of 131 — 7 participants

Back to article view | Back to comp.sys.mac.misc

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

#6731

From	nospam <nospam@nospam.invalid>
Date	2018-11-08 23:18 -0500
Message-ID	<081120182318573468%nospam@nospam.invalid>
In reply to	#6730

In article <2018110820004159341-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> > BUT, the weak point is the user ... you do have to careful about things 
> > like scam emails that may look legit, but take you to faked websites to 
> > enter your details. Best bet is to never go to your online banking via 
> > an email link.
> 
> I may have recently pressed the "Unsubscribe" button recently on an 
> email from what I thought was from my bank.  (I can't remember if I did 
> that.)  After that, on the resultig page (if I clicked on the link), 
> the most data that I might have entered was my email address to try to 
> unsubscribe.
> 
> How can I determine if I have malware?

you more than likely don't, however, if that link was a phish, then
you've been pwned.

[toc] | [prev] | [next] | [standalone]

#6732

From	Tom Evans <tomevans9890@yahoo.ca>
Date	2018-11-08 20:39 -0800
Message-ID	<2018110820392056670-tomevans9890@yahoo.ca>
In reply to	#6731

On 2018-11-09 04:18:57 +0000, nospam said:

> In article <2018110820004159341-tomevans9890@yahoo.ca>, Tom Evans
> <tomevans9890@yahoo.ca> wrote:
> 
>>> BUT, the weak point is the user ... you do have to careful about things
>>> like scam emails that may look legit, but take you to faked websites to
>>> enter your details. Best bet is to never go to your online banking via
>>> an email link.
>> 
>> I may have recently pressed the "Unsubscribe" button recently on an
>> email from what I thought was from my bank.  (I can't remember if I did
>> that.)  After that, on the resultig page (if I clicked on the link),
>> the most data that I might have entered was my email address to try to
>> unsubscribe.
>> 
>> How can I determine if I have malware?
> 
> you more than likely don't, however, if that link was a phish, then
> you've been pwned.

Thanks, Nospam.

I didn't type any account numbers, PINs or credit card numbers on the 
link in the email that I received that appeared to have been from my 
bank, so how could a fraudster gain access to my credit card 
information if I clicked on the "Unsubscribe" link in the email, and 
possibly typed only my email address in the page that appeared after I 
might have clicked on the "Unsubscribe" link?

Tom

[toc] | [prev] | [next] | [standalone]

#6733

From	nospam <nospam@nospam.invalid>
Date	2018-11-08 23:44 -0500
Message-ID	<081120182344335605%nospam@nospam.invalid>
In reply to	#6732

In article <2018110820392056670-tomevans9890@yahoo.ca>, Tom Evans
<tomevans9890@yahoo.ca> wrote:

> 
> I didn't type any account numbers, PINs or credit card numbers on the 
> link in the email that I received that appeared to have been from my 
> bank, so how could a fraudster gain access to my credit card 
> information if I clicked on the "Unsubscribe" link in the email, and 
> possibly typed only my email address in the page that appeared after I 
> might have clicked on the "Unsubscribe" link?

if the *only* thing you typed was your email address, it's probably ok,
but that's impossible to know without examining the link.

[toc] | [prev] | [next] | [standalone]

#6719

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-08 15:59 +0000
Message-ID	<g4j4rkFlb7aU1@mid.individual.net>
In reply to	#6717

On 2018-11-08, Tom Evans <tomevans9890@yahoo.ca> wrote:
> Is Keychain or any other program safe for storing passcodes on a desktop Mac?

Very.

Keychain is a securely encrypted password manager that is built into
Apple operating systems including macOS and iOS. The information in the
keychain is encrypted and stored in an SQLite database on the file
system. 

Keychain can contain various types of data including:

* passwords (for websites, FTP servers, SSH accounts, network shares,
* wireless networks, groupware applications, encrypted disk images),
* credit card details, 
* private keys, 
* certificates, and 
* secure notes

Apple and third-party applications can offer to remember and store
passwords, credit card details, and so on in Keychain so that the user
does not have to type them again upon subsequent logins. For instance,
the Apple Mail application stores your mail account passwords in
Keychain so that you do not need to enter them each time you check
email. The Safari web browser stores login credentials to websites in
Keychain so that the next time you connect to a web site, the
credentials will be entered for you. Third-party apps in macOS and iOS
also routinely store sensitive login credentials and other details in
Keychain for safe keeping.  

iCloud Keychain is just an extension to the Keychain facility that
securely and seamlessly synchronizes your Keychain to all of your Apple
devices so that a piece of information remembered on one device will
automatically be available all of your other devices. So a password
remembered one device will automatically be on all of your other
devices, which means you don’t need to enter it on your other devices.

<https://support.apple.com/en-us/HT204085>

Apple has gone to great lengths to protect the data stored in Keychain
on your devices.

<https://tidbits.com/2014/03/01/how-to-protect-your-icloud-keychain-from-the-nsa/>

The iOS Security Guide white paper provides a lot of technical detail if
you’re interested.

<https://www.apple.com/business/docs/iOS_Security_Guide.pdf>

As with many of Apple’s secure facilities, any new device attempting to
read Keychain information requires one of:

* verification from an existing registered device through a push
* notification with manual acceptance your iCloud Security Code an SMS
* verification to your registered phone number

To enhance security, you can also protect your iCloud / Apple ID account
with two-factor authentication, which causes push notifications to all
registered devices and corresponding email messages anytime your
password is used on a new device.

<https://support.apple.com/en-us/HT204915>

I highly recommending iCloud Keychain, because it is very secure and
greatly increases your productivity.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#6720

From	Chris Ridd <chrisridd@mac.com>
Date	2018-11-08 18:47 +0000
Message-ID	<ps20bj$upm$1@dont-email.me>
In reply to	#6719

On 08/11/2018 15:59, Jolly Roger wrote:
> On 2018-11-08, Tom Evans <tomevans9890@yahoo.ca> wrote:
>> Is Keychain or any other program safe for storing passcodes on a desktop Mac?
> 
> Very.
> 
> Keychain is a securely encrypted password manager that is built into
> Apple operating systems including macOS and iOS. The information in the
> keychain is encrypted and stored in an SQLite database on the file
> system.

Passwords in local keychains on Macs are only protected with 3DES, which 
is an extremely weak cipher.

<https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf>

I would suggest *not* using the macOS keychain for passcodes that I 
cared about. Personally I use 1Password; other secure password managers 
are available.

<https://support.1password.com/opvault-overview/>

-- 
Chris

[toc] | [prev] | [next] | [standalone]

#6721

From	Your Name <YourName@YourISP.com>
Date	2018-11-09 08:10 +1300
Message-ID	<ps21ma$ptc$1@gioia.aioe.org>
In reply to	#6720

On 2018-11-08 18:47:14 +0000, Chris Ridd said:

> On 08/11/2018 15:59, Jolly Roger wrote:
>> On 2018-11-08, Tom Evans <tomevans9890@yahoo.ca> wrote:
>>> Is Keychain or any other program safe for storing passcodes on a desktop Mac?
>> 
>> Very.
>> 
>> Keychain is a securely encrypted password manager that is built into
>> Apple operating systems including macOS and iOS. The information in the
>> keychain is encrypted and stored in an SQLite database on the file
>> system.
> 
> Passwords in local keychains on Macs are only protected with 3DES, 
> which is an extremely weak cipher.
> 
> <https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf> 
> 

Not quite true. They are also protected by your user and admin 
passwords (assuming you set the machine to lock when not used and not 
automatically log on when botting), and can be further protected by a 
firmware password and encrypting the drive (if you forget the drive 
encryption password, you're screwed though!).

> I would suggest *not* using the macOS keychain for passcodes that I 
> cared about. Personally I use 1Password; other secure password managers 
> are available.
> 
> <https://support.1password.com/opvault-overview/>

Like Adobe, 1Password has now stupidly gone down the subscription 
route, so you now have to pay a monthly fee, rather than buying a 
license.  :-(

[toc] | [prev] | [next] | [standalone]

#6722

From	nospam <nospam@nospam.invalid>
Date	2018-11-08 14:22 -0500
Message-ID	<081120181422070830%nospam@nospam.invalid>
In reply to	#6721

In article <ps21ma$ptc$1@gioia.aioe.org>, Your Name
<YourName@YourISP.com> wrote:

> > Passwords in local keychains on Macs are only protected with 3DES, 
> > which is an extremely weak cipher.
> > 
> >
> > <https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/
> > security/docs/MacOSX_Security_TB.pdf> 
> > 
> 
> Not quite true. They are also protected by your user and admin 
> passwords (assuming you set the machine to lock when not used and not 
> automatically log on when botting), and can be further protected by a 
> firmware password

none of that matters.

> and encrypting the drive (if you forget the drive 
> encryption password, you're screwed though!).

that part does.

> > I would suggest *not* using the macOS keychain for passcodes that I 
> > cared about. Personally I use 1Password; other secure password managers 
> > are available.
> > 
> > <https://support.1password.com/opvault-overview/>
> 
> Like Adobe, 1Password has now stupidly gone down the subscription 
> route, so you now have to pay a monthly fee, rather than buying a 
> license.  :-(

nope.

1password exists in *both* a subscription or purchase option. the user
can choose whichever works best for their needs.

[toc] | [prev] | [next] | [standalone]

#6723

From	Chris Ridd <chrisridd@mac.com>
Date	2018-11-08 19:30 +0000
Message-ID	<ps22t4$gh1$1@dont-email.me>
In reply to	#6721

On 08/11/2018 19:10, Your Name wrote:
> On 2018-11-08 18:47:14 +0000, Chris Ridd said:
>> Passwords in local keychains on Macs are only protected with 3DES, 
>> which is an extremely weak cipher.
>>
>> <https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf> 
>>
> 
> Not quite true. They are also protected by your user and admin passwords 
> (assuming you set the machine to lock when not used and not 
> automatically log on when botting), and can be further protected by a 
> firmware password and encrypting the drive (if you forget the drive 
> encryption password, you're screwed though!).

It is common practice to assume the worst case scenario where the 
attacker is able to get a copy of the (keychain) file.

> Like Adobe, 1Password has now stupidly gone down the subscription route, 
> so you now have to pay a monthly fee, rather than buying a license.  :-(

It seems to have been a *very* successful strategy for Adobe.

However 1Password still sell full licenses. I got one for my Macs.

-- 
Chris

[toc] | [prev] | [next] | [standalone]

#6727

From	Your Name <YourName@YourISP.com>
Date	2018-11-09 15:29 +1300
Message-ID	<ps2re1$af$1@gioia.aioe.org>
In reply to	#6723

On 2018-11-08 19:30:44 +0000, Chris Ridd said:
> On 08/11/2018 19:10, Your Name wrote:
>> On 2018-11-08 18:47:14 +0000, Chris Ridd said:
>>> Passwords in local keychains on Macs are only protected with 3DES, 
>>> which is an extremely weak cipher.
>>> 
>>> <https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf> 
>>> 
>> 
>> Not quite true. They are also protected by your user and admin 
>> passwords (assuming you set the machine to lock when not used and not 
>> automatically log on when botting), and can be further protected by a 
>> firmware password and encrypting the drive (if you forget the drive 
>> encryption password, you're screwed though!).
> 
> It is common practice to assume the worst case scenario where the 
> attacker is able to get a copy of the (keychain) file.
> 
>> Like Adobe, 1Password has now stupidly gone down the subscription 
>> route, so you now have to pay a monthly fee, rather than buying a 
>> license.Â  :-(
> 
> It seems to have been a *very* successful strategy for Adobe.

Mainly because there's not a lot of other choice for professional 
users. Quite a few of the non-professional users have already jumped 
ship to other products which although less powerful, mostly suit their 
needs.



> However 1Password still sell full licenses. I got one for my Macs.

Only if you already have the previous version bought under a license. 
New buyers are forced into the subscription model.

[toc] | [prev] | [next] | [standalone]

#6729

From	nospam <nospam@nospam.invalid>
Date	2018-11-08 21:52 -0500
Message-ID	<081120182152392811%nospam@nospam.invalid>
In reply to	#6727

In article <ps2re1$af$1@gioia.aioe.org>, Your Name
<YourName@YourISP.com> wrote:

> > However 1Password still sell full licenses. I got one for my Macs.
> 
> Only if you already have the previous version bought under a license. 
> New buyers are forced into the subscription model.

wrong.

[toc] | [prev] | [next] | [standalone]

#6724

From	Jolly Roger <jollyroger@pobox.com>
Date	2018-11-08 20:22 +0000
Message-ID	<g4jk83Fopm3U1@mid.individual.net>
In reply to	#6720

On 2018-11-08, Chris Ridd <chrisridd@mac.com> wrote:
> On 08/11/2018 15:59, Jolly Roger wrote:
>> On 2018-11-08, Tom Evans <tomevans9890@yahoo.ca> wrote:
>>> Is Keychain or any other program safe for storing passcodes on a desktop Mac?
>> 
>> Very.
>> 
>> Keychain is a securely encrypted password manager that is built into
>> Apple operating systems including macOS and iOS. The information in the
>> keychain is encrypted and stored in an SQLite database on the file
>> system.
>
> Passwords in local keychains on Macs are only protected with 3DES, which 
> is an extremely weak cipher.

Meh. That requires that someone have login access to your user account.
And it's also made irrelevant for many of us who use the built-in
FileVault whole-disk encryption facility built into macOS.

> I would suggest *not* using the macOS keychain for passcodes

I recommend all Mac users secure their data with FileVault, a firmware
password, and Find My Mac. Good luck even getting access to my keychain
data.

> Personally I use 1Password; other secure password managers are
> available.

Been there, done that. No thanks.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [standalone]

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

csiph-web

Is Keychain or any other program safe for storing sensitive data on a desktop Mac?

Contents

#6731

#6732

#6733

#6719

#6720

#6721

#6722

#6723

#6727

#6729

#6724