0

I have been using Apple Keychain to save passwords in not very important sites. Now I will have to store more important information related to money. Are other paying apps like 1password more secure?

1 Answer 1

0

No, technically a 3rd party app is not more secure than Apple Keychain, provided it uses the same encryption algorithm. Apple Keychain uses triple DES, which NIST considers safe enough until approx. 2030. A password manager with better encryption algorithm like AES-256 theoretically improves your security, but practically it doesn't really matter.

What you might consider; when the Apple Keychain is unlocked (at the beginning of the session) the contents are unencrypted in memory. Through a kernel bug, a bug in Darwin's IPC mechanism or in Apple Keychain other applications might be able to access this data for the entire length of the session (until you log off). E.g. you can use command-line utility (such as Keychaindump) to dump the content of it. Using a separate password manager allows you to only have your password database open when you actually need it and close it immediately afterwards, reducing the time the password is in memory.

1
  • You might create separate keychain to store sensitive keys and unlock it when you need it (and lock it when you are done). Jun 11, 2015 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .