Import to Keychain?

Hi, Shaun.

Keychain Access has an Import function (File > Import) but this is only used for importing keychain items from one keychain into another, e.g. into the keychain currently open in Keychain Access. One could use this, for example, to combine two keychains. The Import function is not going to import passwords from Windows apps like Gator and Roboform. Therefore, you'll have to migrate the passwords either individually to your keychain by creating new items in Keychain Access or entering them when prompted and, if additionally prompted, then saving them in your keychain.

Note that not all Web pages or web browsers are Keychain-aware: sometimes you'll be prompted to save a Web page ID/Password in your keychain, other times you may not. For example, some Web sites save ID/Password info in encrypted cookies.

Good luck!

😉 Dr. Smoke
Author: Troubleshooting Mac® OS X

Financial websites disable auto-filling fields from cookies for security reasons. Some browsers have auto-fill features that override the webmaster's instructions. iCab has full-featured autofill setup, and I believe Firefox and Safari have some limited autofill feature.

There are known vulnerabilities with Firefox and Safari and auto-fill.

CIS Finds Flaws in Firefox v2 Password Manager
(CIS) has discovered a new flaw in the Mozilla Firefox web browser that exposes saved passwords to clever attackers.

Firefox Password Manager Information Disclosure (SA23046)
A vulnerability has been discovered in Firefox, which can be exploited by malicious people to conduct phishing attacks.

Critical Firefox hole allows password theft
The flaw lies in Firefox's Password Manager software, which can be tricked into sending password information to an attacker's Web site

Phishing potentiality affects Safari, Firefox password storage
Heise Security reports on a phishing vulnerability caused by Firefox's password manager. In a nutshell, because Firefox has the ability to store field entries so it can automatically insert usernames and passwords for previously visited Web sites, maliciously crafted sites can coax the information out and trick the user into submitting (or automatically submit) the private data.

We were able to reproduce this bug in-house using both Firefox 2.0 and Safari 2.0.4 under Mac OS X 10.4.8.

For Firefox, this situation can be prevented by simply going to the "Security" pane of the application's preferences and deselecting the "Remember passwords for sites."

For Safari, it can be prevented by going to the "AutoFill" pane in the application's preferences and deselecting "User names and passwords."

From www.macintouch.com and MacFixit Friday.