Locking, Touch ID and auto-lock
When Remem locks, how to set the idle timer, how Touch ID unlock works and what it stores, and how the extension locks.
Last updated
A locked vault has thrown away its key. Unlocking takes your master password, or Touch ID if you turned it on.
Lock it yourself
Press ⌘L, choose Security → Lock now in the menu bar, or select Lock the vault in the toolbar.
Automatic locking
In Settings → Locking:
- Lock the vault when idle: After 1 minute, After 5 minutes (the default), After 15 minutes, After 1 hour, or Never on idle.
- Lock when this device sleeps: on by default.
Only things you do count as activity: opening, revealing, copying, filling, saving, scanning and Sync now. A ticking code or a background sync doesn’t keep the vault open.
About “Never on idle”
Remem can’t tell when you lock your Mac’s screen. With Never on idle, Settings says so: “Remem cannot tell when you lock your screen, so with no idle timer the vault stays open until you lock it yourself or this device sleeps.” Locking your screen and walking away leaves the vault open behind the lock screen. Choose a timed option unless that is what you want.
What locking does
Every lock, however it happens, discards the vault key, clears decrypted items from every window, takes a secret Remem copied off the clipboard, hides the quick panel, turns screen-capture protection back on and forgets every approval given to the remem command. When the Remem window loses focus, revealed secrets are hidden again, but the vault stays unlocked.
Turn on Touch ID unlock
- Open Settings → Unlocking and switch on Unlock with Touch ID.
- Enter your master password in Confirm your master password and select Enable.
- Next time, the lock screen offers Use Touch ID, with Use password… as the alternative.
On a Mac without Touch ID, the switch reads Unlock with your password. Turned on, the vault opens with your Mac’s login password instead of your master password, so think twice before using it. On a Mac with Touch ID, the prompt can also fall back to your Mac’s login password.
How Touch ID unlock works, honestly
- Turning it on stores the key that unlocks your vault in your Mac’s Keychain. Remem asks for Touch ID before reading it.
- It keeps working after a restart, until you turn it off. A new device still needs your master password and Secret Key.
- The Touch ID check is made by Remem, not enforced by the Keychain. Software running as your Mac user could read that Keychain entry without a fingerprint.
- Anyone who can pass the Touch ID prompt, including with your Mac’s login password, can open the vault on that Mac.
It is a convenience. If your Mac user account is shared, or you worry about malware running as you, leave it off. Switch it off in the same place.
The browser extension
The extension locks when the browser closes and when you choose Lock in its menu. In Chromium browsers it also locks when your Mac’s session locks; Firefox may not notice that, so lock it yourself there. It has no idle timer. In Chromium browsers it can unlock with Touch ID through the Mac app; see the browser extension.
Was this missing something? Write to hello@remempass.org.