I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill.
*Edit: Actually it looks like you can set Keychain to lock automatically after X minutes of inactivity or when the computer sleeps.
Better yet, open "Keychain Access", go to the preferences general tab, and click "Show keychain status in menu bar". Voilà, now you can lock and unlock keychains without switching applications. (This has been around for a long time, too.)
Don't forget, unlike windows, LOCKING a mac is not easy. The only way I know is to use the lock command of Alfred. In windows: Windows + L = lock boom. Because of this, most people in the office leave their macs unsecured.
Comments
I don't think it's obvious that Keychain isn't automatically secure within a logged-in user account. Apple makes a big deal about their products being intuitive, "it just works." They really ought to implement the system that Lastpass and other password managers use and allow the user to separately "unlock" Keychain before the passwords autofill.
*Edit: Actually it looks like you can set Keychain to lock automatically after X minutes of inactivity or when the computer sleeps.
Better yet, open "Keychain Access", go to the preferences general tab, and click "Show keychain status in menu bar". Voilà, now you can lock and unlock keychains without switching applications. (This has been around for a long time, too.)
Don't forget, unlike windows, LOCKING a mac is not easy. The only way I know is to use the lock command of Alfred. In windows: Windows + L = lock boom. Because of this, most people in the office leave their macs unsecured.
Ctrl-shift-eject (not the most intuitive combo, but here you go)
It's certainly not obvious to a normal user, and that's fine. But if you even somewhat understand security this should not come as a surprise.