1

I find that my passwords are being copied from my "bank" keychain into the login keychain every time I allow Safari to autofill the fields. How can I prevent that?

I have created a separate keychain called "bank" to store my sensitive financial account passwords. I use a different keychain password and set it to lock automatically after 5 minutes.

Improve this question
2
  • Short answer, its by design in Safari. All passwords saved in Safari will be stored in the default/Login keychain. I could suggest using an app (such as 1password) instead and not letting Safari manage/autofill passwords at all.
    – Niklas
    Mar 2, 2017 at 10:23
  • I created a Radar for this and I recently got an email from Apple (on Feb 27) that they have fixed it in a security update (presumably upcoming). The OpenRadar is here: openradar.appspot.com/radar?id=4965515323768832
    – Simon Woodside
    Mar 3, 2017 at 5:02

1 Answer 1

Reset to default
1

This was a security bug and a fix was released today by Apple.

About the security content of Safari 10.1:

Safari Login AutoFill

Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.4

Impact: A local user may be able to access locked keychain items

Description: A keychain handling issue was addressed through improved keychain item management.

CVE-2017-2385: Simon Woodside of MedStack

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .