2

My MacBook running El Capitan just got stolen. It was in hibernation, and will display a password prompt on opening the lid next. Assuming a not-very-technical attacker and a solid login password, how likely is it that my account passwords from keychain will leak?

  • I will of course change them, but am in the middle of a Conference now and have very restricted possibilities. – jstarek Apr 11 '16 at 13:04
  • Assume that if someone has your machine, they have your data. Macs [& PCs] are nowhere near as hard to get into as iPhones. See apple.stackexchange.com/a/198951/85275 – Tetsujin Apr 11 '16 at 15:11
  • 1
    Thank you all for your thoughts. I've calmed down a bit and reset most things now -- easier said than done when all you have left is a smartphone. As long as the keychain is encrypted, I feel better. – jstarek Apr 11 '16 at 22:26
1

To answer your main question - they are very unlikely to leak if you stored them in keychain.

  1. The attacker would have to know your login password to access every keychain item.

However - you still need to change them (as you said you would) - especially your email password!

First and foremost the attacker may gain access to your email through your MacBook, if they find a way to circumvent the password prompt! This is your biggest concern in general as most passwords can be reset through email verification.

Regarding the live-Linux-boot or safe-boot options to access your data, this depends entirely on the question if you have enabled FileVault, which would prevent this (your hard-drive is encrypted in this case) and can't be loaded without knowing the password.

Regarding the "safe" password idea. You mentioned you are at a conference, where possibly many other people could have easily recorded you entering your password or watched you enter it. If you have been targeted specifically, a simply video taken with a smartphone could have easily gone unnoticed by you and your login may be compromised...

2

Your keychain is encrypted with your login password, so the passwords stored in it should be pretty safe as long as they aren't somewhere else, too. Unfortunately, information sometimes leaks, so there may be notes, password reset emails, etc lying around unencrypted and potentially readable by whoever stole the laptop (or their fence, or...). So in theory your passwords are safe; in practice, you should reset them all.

1

Your data is stored in a non-encrypted form onto your Macintosh HD. A password prevents the users from loading the OS, not from accessing your data. Said that the only way to protect data is encryption, a thief could actually insert a Live USB Bootable device (free and easy to create) with a Linux distro on it (like Ubuntu), mount your HFS+ partition, read the drive, copy it to an external Hard drive as an ISO (Ubuntu has the needed tools preinstalled for doing this) and - at the end - extract your files from the image using a Mac, Linux or Windows PC and maybe even steal your Passwords. This sounds hard to do, but it is very simple, and anyone can do it: I once did this (by extracting a test.txt file located on the Desktop) with my friend's PC to prove him Macs are vulnerable too. You better change all of your passwords: your data is at risk!

  • Also, if you ever logged in to an online shopping site (or even worse a banking/stocks trading one), you better even re-create the credit card (blocking your current one and purchasing one with a different ID, expiration date and CVV) – Manchineel Apr 11 '16 at 14:42
  • How do you know it's non-encrypted - maybe the OP is using FileVault, which is a one-click to enable full hard drive encryption option in OS X. I am not sure if it's enabled by default, but I think there is at least a prompt during initial setup. – Chris Apr 11 '16 at 21:16
  • The drive should be encrypted, but thanks for the scenario. – jstarek Apr 11 '16 at 22:24
  • Only if you use FireVault – Manchineel Apr 13 '16 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .