Mac OS X Security: Using Keychain
The keychain service found on Mac OS X is significant for two major reasons. First, it uses strong cryptography. Over time, many applications have provided the capability to store passwords but have failed to do so in a way that can be trusted or considered safe from compromise. Second, the storage and retrieval of all passwords is handled by a single service, not individual applications. After you have decided to trust this service, any time you are asked to store a password you dont have to worry about the means by which it is protected. What you do need to be careful of, though, is what applications you allow to make use of your keychain(s). When you unlock a keychain and allow an application to access a password, you open the door for that application to slip up and compromise the security of that password (more on this later). Although the keychain provides strong secure storage for passwords, any application can make use of the keychain API. Thus, be mindful of the applications for which you grant access to your keychain(s).
In this section we will discuss keychain management and configuration with Keychain Access.app and discuss some general security considerations regarding the use of keychains on Mac OS X.
Using the Keychain Access Application
The initial settings for the default keychain leave some room for improvement.
First, we recommend turning on the keychain menu bar icon. This icon allows you to quickly see if any of your keychains are unlocked. The locked icon means all keychains are locked, whereas the unlocked icon means at least one keychain is unlocked. The pull-down menu for this icon also allows for the locking and unlocking of each keychain, including an option to lock all keychains. Another nifty feature of this icons menu is the capability to lock your screen if you have a password-protected screensaver setup. But be careful, this will only lock your screen if you have your screensaver configured to prompt for a password, otherwise it simply starts the screen-saver. To enable the keychain icon in the menu bar, choose the Show Status in Menu Bar option from the View menu of the Keychain Access application.
Second, we recommend some adjustments to the settings for the default keychain. With your default keychain selected, from the Edit menu, choose the Settings option. This brings up the Settings dialog similar to that shown in Figure 5.2.
At the very least, be sure the Lock When Sleeping option is checked. Although it can be cumbersome to re-authenticate on waking up the machine, it means anyone else who has access to it in that state will also have to supply a password. Next, specify a reasonable idle timeout value for the keychain. After a certain number of minutes without use, the keychain will automatically become locked. This is a good idea in case you find yourself away from your machine for an extended period of time. Finally, if you do not want your default keychain to be unlocked automatically after logging in, change the password for that keychain. When logging in, you can then easily unlock the keychain through the menu bar icon or wait for an application to request a password stored in that keychain.
Creating a Secure Note
The bottom half of the Keychain Access window contains a tabbed view pane for configuring attributes and settings related to access control for each keychain item. The Attributes pane (see Figure 5.4) consists of metadata about the item, including the name, description, username, and URL associated with the keychain item. The Show passphrase check box allows you to view the passphrase for that item. Showing the password for an item requires you to enter the keychain password unless access is always allowed as described in the next section.
The Access Control tab (see Figure 5.5) is where all the access control settings for the selected keychain items are configured.
The Confirm before Allowing Access option always prompts the user for permission before releasing a passphrase (unless that application is in the always-allowed list described here later). If the Ask for Keychain password box is checked, not only is the user informed upon each access request, but the user is also required to enter the keychain password before the passphrase is released. Underneath the access options is a list of applications that are always authorized to retrieve the passphrase from the keychain. That is, any application found in this list has access to the passphrase without having to inform the user or ask for approval (provided the keychain is unlocked). When applications add passwords to the keychain they sometimes add themselves to this list. If you have a passphrase you want to keep tight tabs on, it is a good idea to keep this list empty so that you are aware of every request for that passphrase.
The Keychain Access Dialog
To Deny access means that the user must then specify the passphrase for the application and the keychain is ignored.
To Allow Once grants the requesting application access to the password. Subsequent requests display this same dialog.
To Always Allow changes the configuration for this keychain item by adding the requesting application to the always-allow list.
This dialog also may request the keychains password if the Ask for Keychain password option is set. It is a good idea to show the details on this dialog to verify the application path of the application that is requesting access to the passphrase; by default these details are hidden.
Is the Keychain Safe?
As a user, dont assume that because an application makes use of a keychain that any involved passwords are automatically safe. Also, periodically audit the access lists of each item in your keychain file to be sure that only the necessary applications are allowed access.
Potter, Novell, and Wotring. MAC OS SECURITY, ©2003 New Riders Publishing, Reproduced by permission of Pearson Education,Inc., Publishing a New Riders Publishing. ALL RIGHTS RESERVED. Go Here to buy this book at a 30% discount