Macos – stickies ( Sticky Notes) stored on mac 10.9.3

By default, Keychain Access shows the login keychain. If the sidebar does not show any other keychains to choose from, then hit Command-K (menu View » Show Keychains) to see more choices.

On my Mac, both the login keychain and the system keychain show the same AirPort Network password, though the latter is a few years older. The first seems to be used by name and the latter by MAC-address. When looking at the Access Control to see which application can access the passphrase, then one sees some differences as well. But for another Wifi network I only have an entry in the login keychain. (Maybe the system keychain was used in previous versions of Mac OS X, but is still used if no entry in login is found?) I guess deleting all that matches indeed seems the best thing to do.

(As a side note: when one has mounted some network drive with limited credentials, and one wants to change that credentials even when the old ones are still valid, then one also needs to search in the system keychain, not in the login keychain.)

The hashes were in /var/db/shadow/hash/ in 10.6 and earlier, but they are stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8.

You can print the hash data with DaveGrohl (sudo dave -s $USER) or something like this:

sudo defaults read /var/db/dslocal/nodes/Default/users/$USER.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

If automatic login is enabled, the password of the login keychain is also stored in /etc/kcpassword encrypted with XOR cipher.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'