Investigating Keychain access rather than 1Password

[DaveWT]

I have been (and still am) a huge fan of 1Password (on my Mac and iPhone) but as I hear about improvements to Keychain Access I thought I should give it a look and have added a lot of my 1Password login info to Keychain Access. One aspect worries me and I may have overlooked a setting.
As an example, logging into this forum, when I depended on 1Password, I would hit the login button here, and it would prompt me for my username and password. I could then click on the 1Password icon at the top of Safari and type in my 1Password login info (the one password I need to remember.) from there is offered the login info for this forum and I could click on it and proceed to login.

Now that I have the same info entered into Keychain Access, when I come to this forum and click on the login button here, a little box pops up offering the login info for this forum and I just have to hit the return key to let it continue on at logging me in. i.e. Keychain Access never prompts me for its own password. Anyone with access to my computer can get into any of the websites for which I have supplied my login info. In my case, not really a worry as I don't have anyone in the house I mistrust, so it is more of a philosphical question. But is there some setting I have overlooked that would force me to actually log into Keychain Access at this point, as 1Password does, before granting access to the website I am trying to get into?

I have played with Safari Preferences > Autofill and unchecked "User names and passwords" but that seems to kill use of the Keychain Access stored info altogether rather than just making me sign in before offering the needed login info.

 

[DaveS]

I never got into 1Password, and have used Keychain for quite awhile. It was only a couple updates ago, that I noticed that it always seemed to be open. I, too, have no concerns here for security, but it still bothers me that I don't seem able to have it set so that the master password is required to open the app. Since Firefox saves passwords, too, I've never been sure how the automatic feature would work. If it's a login I don't remember, I usually open Keychain, find it, and then copy and paste. But perhaps there's a distinction I'm missing between Keychain and Keychain Access.
Dave S

 

[chas_m]

You authenticated Keychain when you signed into your account with your account password. Other than someone maliciously trying to use keychain when you have stepped away from the computer but not signed out, there is little risk because the person who is trying to gain access to keychain would have to have your account password.

 

[DaveWT]

Ah, thanks Chas, That was the bit I was overlooking. I feel better now about using the stuff I have saved in my Keychain.

 

[DaveWT]

But perhaps there's a distinction I'm missing between Keychain and Keychain Access.
Dave S

In my simple mind, I think of Keychain Access as the utility you might use to get at the stuff you have saved in your Keychain. You can also see the same login stuff by going to System Preferences > Passwords and logging in with your account password. And a third way is to go to Safari Preferences > Passwords and log in with your account password.

I guess the reason it will accept that you have already logged into your account when you visit a website and Keychain fills in the stuff for that website without again asking you to log in with your account password again is that in this case, you are only "exposing" the stuff for one website whereas in the other methods I described above, you are exposing all your password stuff.

 

[chas_m]

“Keychain” refers to the technology of creating, cataloguing and managing your stored passwords.

”Keychain Access” is the name of the original program for accessing the Keychain. It’s still there because it offers some granular controls and info the other methods dont, but it has been mostly superseded for most users by the easier access to passwords offered via System Preferences and, more recently, Safari.

1Password is a great company and their family plan is still something I recommend for some use cases, but for most individual users just Keychain alone is sufficient.

 

[Cougurr]

I just wanted to add that my new M1 iMac works differently than my 2015 MBP Laptop. Have to admit one running Big Sur, older one has been held at High Sierra, and this may be why ? in part. Moved away from my One Password where I had to add that high level password every time I was doing a login on either machine. Now when I select the KeyChain login with my mouse on the MBP it just conveniently opens the site or location I am logging into. Personally happy to not be constantly entering the One Password "Password" However things are different on my M1. The keyboard supplied with this iMac has a finger print ID key. Every time I do a login on this M1 machine it asked me for my fingerprint to add the user then sometime also the password, if I don't and click it then says use my computer login password (NOT keychain PW) and then allows me access. Perhaps I need to still change some setting on this newer machine to avoid the need of finger print bit it is not really inconvenient and easier than entering any password for sure.

 

[DaveWT]

I am no expert in this area, but my wife's MacBook Pro has the fingerprint reader on its keyboard. If she has shut down the computer and starts it up, she will need to type in her login password. But from then on, if she walks away and it screen saves, she can get back in with just her fingerprint - no need to type in her login password. In both her case, and on my iMac, the login password is the same as the Keychain password whereas you seem to be implying that you have a login password and a different keychain password. Can that be part of your issue?

 

[Cougurr]

Having a mind blank on this and went back in this morning to check on my access to Keychain. Your correct on the fact that my computer access is also my keychain password. Bottom line is I just never remember putting in this keychain password ever, so it must inherit the computer access password when it is activated or used on the Mac. I have a couple of computers online as noted for work at home and both are offspring of much earlier computers from when I moved over to Mac OS 10 from OS 9 days. Each one has been created from a time machine backup of its parent. So passwords and access passwords have just moved from one into the next without me ever thinking about them. Bottom line is I am finding Keychain easier to use than 1Password and since we are all Mac now it just makes more sense to stick with it.