Improving FileMaker Security—The Keychain Killer

The Keychain Killer

Improve Security by setting FileMaker Authentication to ignore account names and passwords stored in keychains and password utilities.

These techniques will keep FM files from even trying passwords stored by someone clicking a checkbox during login, making sure that each user must enter their account name and password to open the file.

As developers, it is our job to assure that systems we provide meet valid security requirements in spite of computer systems increasingly trading away good security for ease of use.

Our example file shows how to stop FileMaker Authentication from using passwords stored from a keychain. This method takes only a few minutes to setup, requiring setting the File Options to use a default account login with only permission to perform a relogin process.

Implementing this technique can significantly reduce the risk of unauthorized access to FileMaker served data via computers in the wrong hands — even if implemented after a laptop is lost — but, the earlier, the better. Why wait?

download button
Keychain_ Killer

Sample File: — 685 KB

The example file uses these credentials for valid login:
Account Name:  Admin
Password:  Password

The zipped directory contains a FileMaker example file and a PDF explaining the script and file setup to implement this technique in under 10 minutes.

This technique alone does not assure full compliance with security requirements, as it addresses only the issue of stored passwords.



Setting the File Options to Auto-Login with an invalid account has been found to fail to bypass stored credentials with some combinations of FMP clients and OS versions, so that is no longer considered a safe technique.


The technique in our example file can be implemented on served files which use FileMaker Authentication even after a computer with stored credentials has been lost or stolen, but it is too late to implement this for local files stored on a computer in the wrong hands.


Credentials for all systems which might have been stored on a lost computer should be changed immediately across all systems, including email accounts, as a precaution against the next user of that computer extracting credentials from its keychain utility and entering them manually to breach a hosted system.