I'm a new to Mac and found that Keychain has gathered quite a lot of passwords so far. I'm concerned about the security of these data, and I would like what security settings would you recommend so that my keychain data is secure?
Maximum security if you’re that worried. Otherwise, just enable
Lock when sleeping.
I’m not that worried because to view the password in Keychain Items requires your account password.
The security of your keychain depends upon two things.
- Who has access to your Mac both physically and to log in.
- How secure your password is.
The first is quite easy to control. Don't let anyone you don't trust have an admin account on your Mac or have access to the backups and room where the Mac sits. If someone never gets a hold of your keychain file(s) then they can't use them or try to crack into them. Even guest users (or non-admin users) could potentially find a loophole and escalate their privileges to root/admin and then get a copy of your files, but this is a rare unlikely situation for most people that don't work in tech security fields. Governmental agencies, etc... of course probably can readily snatch that file if they should be interested in you or your Mac.
The security of your password is what secures the keychain even if someone has possession of the file. If you use a unique password there (one that isn't used on other services such as email, Facebook, online banking, etc...) is far more secure than a common password. Also, a longer password is far, far harder for someone to crack using brute force computations or a rainbow table should one be identified for the keychain (I haven't heard of one since I believe OS X salts that password sufficiently - but it's certainly possible someone could figure out that or Apple could have made an error in the coding of that password handling.)
In short - to most people - the keychain is highly secure - far more so than most any other storage of passwords they might use. A large majority of people make keychain insecure with simple, short, well-used passwords. If you are quite concerned, you could also store unimportant items in the login keychain and make other keychains with separate passwords for the secure items. You could also look into a dedicated product such as 1Password that have devoted significant amounts of funding to work to secure passwords. I'm certain Apple has spent a lot of money on the keychain - but like any physical security, the more secure it is, the less convenient it also is. There is a trade off between maximum security and maximum utility so you'll want to educate yourself until you are comfortable that you understand things and then make a good choice for your needs.