Keychain Demystified
What is it?
This is a subsystem BUILT-INTO OS X. It cannot be removed. It cannot be disabled.
Every time you use a username and password and the app or OS asks you if you want to save this information, it's saved in your login.keychain file. Beyond that, depending on whom you ask the keychain is either..
An AES encrypted file with encryption based on the user's current password that saves all sorts of pertinent things like passwords, logins, certificates, and whatever else you want to throw it at..
OR
A mysterious female-goddess who laughs at your keening wail of ignorance as you plead with her to no avail.
Where Is It?
The keychain for each user lives in ~/Library/Keychains/
and the primary one we're looking at is login.keychain
The ~
above is UNIX nomenclature that refers to the 'current user's home directory'. So if you were user gschipp
, then ~/Library/Keychains/
would mean /Users/gschipp/Library/Keychains/
This can be confusing, since there is a Library folder in the root of the drive. They keychain prompts that pop up are 99.999999999% of the time ONLY linked to the current user, and are therefore in their home directory within their Library
folder.
Why Does It Do Me Like This?
Your keychain is an encrypted file. It is "closed" and "locked" when you're not logged in, but it "unlocks" and "opens" automatically when you login, so your applications can ask it cool stuff like, "what was the password for my AllThingsTchotchke.com account?". As long as you're logging in with the same password it was encrypted with, it'll unlock & open with no issues.
Presuming you subscribe to the former definition above, when your password changes, the AES encrypted keychain no longer can "unlock" and "open", prompting you with a request to update the password, reset and start over, or continue only to be annoyed again later.
The Options
Note: These are part of the OS, again, built-in and immutable.
- CONTINUE
This is the "I'm too lazy to read, ask, comprehend, and/or weigh my options" button. Typically this is the reason that people complain about their keychain prompting them repeatedly.
When to use? NEVER
- RESET KEYCHAIN
This will ERASE the keychain. ERASE as in gone. Not recoverable. Not renamed. Not moved to the Trash. Straight up DELETED.
The good news is that this will fix all the keychain issues and reset it to like the first time you logged in.
The bad news is that all the passwords et al... gone forever.
When to use?
ONLY If the user cannot remember their old password.
- UPDATE KEYCHAIN
DING! Choose me!
This is the route that people should always take. This is unlocking the encrypted file and relocking it with a new password. Choosing this will immediately prompt for a password.. their OLD password, i.e., the one they were logging into the Mac before their changed their password. If that password doesn't work, then it's an older password that it's locked with. Key trying them until they are forced to go with the RESET option.
This simple step will take care of 99.999999999% of all keychain "issues".
When you use?
ALWAYS, unless the user doesn't remember their previous passwords.