Mac® Security Bible

5.4. Safari and the Keychain

Many of the applications included with Mac OS X make use of the Keychain but none quite so extensively as Safari. If you configure Safari to do so, it can save usernames and passwords in your keychain for nearly any website you visit and restore them automatically when you return in the future. This capability can be a fantastic convenience feature, an aggravating annoyance, or a significant security risk, depending on how you use your Mac.

Safari's form-filling integration with your keychain is disabled by default. To enable it, follow these steps:

1. Open Safari, which is located in /Applications.

2. Choose Safari Preferences to open Safari's Preferences window, and then click AutoFill to open the AutoFill pane, which is shown in Figure 5.6

3. Click the User names and passwords check box.

4. Close the Preferences window.

With this feature enabled, Safari offers to save usernames and passwords you type into forms on web pages as soon as you click the Log In (or equivalent) button. Click Yes to save the credentials to your keychain, Not Now to skip it (but let Safari ask again later), or Never for this Website to skip it and suppress future prompts for this site. The next time you visit a page for which your credentials are saved, Safari enters them automatically as soon as the page loads.

Figure 5.6. Safari's AutoFill preferences don't mention the keychain anywhere, ...