MacWorks is a member of the Apple Consultants Network

Is it safe to store my Credit Card information in AddressBook?

I keep credit card info in Address Book, but now I'm starting to think that's a bad thing. If I lost my iPhone, it would all be there for anyone to take advantage of.

I do it, because I can copy numbers rather than enter them, and I don't have to hop up and find my wallet when I'm at the computer.

Is there a protected solution for this?

Answer

Indeed there is. It's called ... the Keychain!

But before I delve into the Keychain, I should mention that you can add some protection to your iPhone by turning on the Passcode Lock feature. To enable it, go into the 'Settings' application ...

image

Select 'General' ...

image

Select 'Passcode Lock' ...

image

You'll then be prompted to create a four digit passcode which will be used to 'unlock' your phone from it's sleep mode ...

image

Adjust the 'Require Passcode' setting for how long to wait (after falling asleep) to require the passcode ...

image

For maximum security, set it to never. If you find yourself a little annoyed by having to enter the passcode so often, then set it to a more reasonable number like 1 minute, 5 minutes or 15 minutes.

THE KEYCHAIN:

In a stroke of genius, Apple built the Keychain application as a part of Mac OS X. The Keychain is really two-fold. There's the application (software) part of it and then there are the actual 'keychains' themselves. The keychains are encrypted files that store username and password information for web sites that you visit, public & private certificates for web services and other servers you might use, passwords for connecting to wireless networks, passwords for servers that you connect to for file sharing purposes ... even your .Mac / MobileMe and iTunes store passwords are stored there.

PURPOSE:

The Keychain's purpose is to both store your sensitive information securely AND to give you and your software convenient and easy access to that information.

When you log in to your computer, your keychain is 'unlocked' by virtue of you having entered your Mac OS X account password to log in. If your computer automatically logs in when you turn it on, your keychain is still unlocked. It's automatically unlocked for you so that the software you are running can request sensitive information from it on-the-fly.

For example, when you log on to a web site that you have an account with, it will automatically populate your username and password so all you have to do is select the sign on button. Note that some sites don't allow this automatic population -- especially banking and other financial sites.

You might notice that when you sign into a new account that you're asked if you want to store the password in the keychain. If you'd prefer to type it in manually everytime you log into that account, say 'No'. If you say 'Yes', the computer will automatically store the username and password into the Keychain.

Another example is when you join a wireless network that requires a password. The first time you sign on, you must enter the password and as long as you check the 'store password in keychain' checkbox, it will store that password in the keychain for you so that next time your computer is in range of that network, it will automatically sign you on by requesting the password from the keychain and submitting to the wireless device.

When you log out of your computer (or shutdown), your keychain automatically locks so that nefarious folks or curious children don't get into your sensitive information. And if someone were to physically take your computer, they wouldn't be able to get into the contents of your encrypted keychain files without knowing your Mac OS X account password (the one you use to log in, install software, etc). This is why it's critical that your Mac OS X account password be secure especially if you are worried that someone might gain access to your computer or that you might loose it (in the case of a laptop).

SECURE NOTES:

The Keychain also contains a 'Secure Note' function which allows you to store arbitrary information in a secure way. For me, I find it useful to store all the serial numbers for software that I purchase in secure notes. From the File menu, I choose 'New Secure Note Item'. In the title, I enter 'SERIAL NUMBER: ' followed by the software's name ...

image

In the future, when I need to look up a serial number, I can use the super-fast find bubble located in the upper-right corner of the Keychain application to quickly locate what I'm looking for.

If you find that your storing credit card numbers in easily accessible places like in a stickies note, a text file, a word or excel document, etc, you might want to consider familiarizing yourself with secure notes. Within a minute or two, you'll be completely comfortable with creating and viewing secure notes and you'll feel a whole lot better knowing that your sensitive information is stored in a more secure way.

ACCESSING & MODIFYING KEYCHAIN INFORMATION:

On occasion, you'll find yourself wanting to lookup a password or other information that you've stored in the keychain. Simply open the keychain application (located in Applications > Utilities), and type into the search field in the upper-right corner to narrow the list down so you can quickly find what you're looking for. Once you've located the item in the list, double-click it to open it up. You'll see something like the following ...

image

or this ...

image

To access the 'sensitive' part (the password or secure note), click the 'show note' or 'show password' check box in the lower-left corner. At this point, you'll be prompted to enter a password ...

image

You are trying to retrieve a password, but instead they are being asked to enter one? What? This is where most people get 'thrown off'. The keychain is asking you to enter your Mac OS X user account password ... the same one you enter to log in to your computer, install software, etc. This is done to ensure that if you walk away from your desk and someone else walks up and starts poking into your keychain, they don't have access without knowing your Mac OS X account password. Once you enter your password and click 'Allow', you'll be able to see the password or secure note. You also have the option to manually modify if information has changed.

TIP: If you find that you're using the Keychain often, don't forget to drag the Keychain application to the dock!