I work in the Security group here at Wesabe, and I just thought I’d point out
that the fact that the login keychain is often unlocked does *not* mean that
any application has access to its contents. The Mac Keychain only allows
“trusted applications” to access individual keychain entries: unless users
specifically grant access to the “Wesabe Widget” keychain item to other
programs, the only application that can read it will be the “DashboardClient”.[1]

The result of this is that I’m not sure moving the Wesabe widget password to a
different keychain is going to do much. If a user gives a malicious program
access to the Widget keychain item, then it doesn’t matter which keychain the
Widget uses. (Note that this can’t happen accidentally — the user would have
to explicitly grant such access.)

That said, your comment about setting keychains to lock brings up a good
point. By default, the login keychain on OS X is *not* set to lock
automatically, even if the computer goes to sleep. Apple set these defaults in
the interests of usability — most users don’t want to be prompted for their
password all the time, no matter what the marginal benefit — but more
paranoid (or just plain curious) users may want to change them.[2] This will
limit the amount of time passwords are stored in memory, and will protect your
passwords even from someone who steals your computer while it’s running…

Of course, if you have any other questions about Wesabe security, or ideas
about how to improve things, please don’t hesitate to send a note to
support@wesabe.com. We take these things really seriously here, and we’re
always happy to hear what people think…

-sq

[1] You can check this yourself by opening Keychain Access
(/Applications/Utilities/Keychain Access.app), double-clicking the “Wesabe
Widget” item, and looking in the “Access Control” tab.

[2] You can change the settings by opening Keychain Access, as described in
[1], ctrl-clicking the keychain marked “login”, and selecting the “Change
settings” option. I set mine to lock when sleeping and after 5 minutes of
inactivity, and I don’t find it too annoying. (But then again, I probably have
a higher tolerance for this than the average user…)

You could re-use your Wesabe account password for this new keychain, if it already strong and unique — if a bad actor ever compromised the password to your Wesabe keychain, they could by definition learn the password it’s protecting. Fortunately, Keychain’s encryption has a good track record.