How do I make macOS not use iCloud Keychain (or its sync area, Local Items, while iCloud KC is turned off)?


For various reasons, I don’t want to use iCloud Keychain. This seems to have gotten harder with 10.11 or 10.12 (upgraded directly 10.10 -> 10.12 so I don’t know what happened when).

Today, I noticed the following:

  • iCloud Keychain was turned on without my knowledge[1]. A few new-ish Credentials (+ automigrated WiFi-password Items) apparently were already synced.
  • Turning it off still leaves the same keychain contents, under the name Local Items. Even if this doesn’t get synched while it's turned off, turning it on is apparently easy to do by mistake, so I would prefer it wouldn't use the sync area at all.
  • ssh-add ignores identities preexisting in the login keychain and only loads from / saves to the iCloud Keychain (or Local Items, if sync's turned off)

I would like:

  • new items going into login Keychain once again, not into Local Items / iCloud by default (best would be not seeing these things at all)
  • ssh-add -A going back to finding items in all unlocked keychains including login where I have quite a few items that it currently ignores and that I don't want to have to redo

These changes seem to be quite persistent, though - I even tried giving the directories with the weird "UUID in Uppercase" looking names in ~/Library/Keychains that seem to be associated with iCloud Keychain to root: – ssh-add -K still wrote the passphrase to Local Items[2].

[1] I can’t remember ever opting in, but IIRC it does ask, so I probably was typing when some focus stealing dialog where space meant yes popped up or something. [2] But no reboot in between - maybe some server just still had a preexisting handle for them, didn’t investigate that part further yet.

You must log in to answer this question.

Browse other questions tagged .