Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Killing the Password. Here’s Everything You Need to Know

wired.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#51

Post by izacus »

threeseed wrote: post #30
izacus wrote: post #26

Earlier quoted context omitted.

In words of Tim Cook on the last event: "Just buy an iPhone (or a Mac and an iPad)". Making your experience bad on non-Apple devices is part of the design, not accident.

I worked at Apple and no one is deliberately making the experience bad on non-Apple devices. They just have a million things they want to do, limited resources and so they simply don't prioritise it.

The CEO of Apple just publicly said something that contradicts your working experience. I'll trust him to clearly explain the strategy over your experience.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#52

Post by blooalien »

threeseed wrote: post #29
mort96 wrote: post #21

Earlier quoted context omitted.

Aha, so you get a significantly worse experience if you're not 100% in the Apple ecosystem, and you can't sign in at all if you don't have your Apple device on you. I'll keep using passwords, thanks.

If you are using passwords that you can remember without your phone then I assume it's pretty basic and insecure.

Obligatory XKCD: https://xkcd.com/936/

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#54

Post by sbuk »

mort96 wrote: post #46
threeseed wrote: post #29

Earlier quoted context omitted.

If you are using passwords that you can remember without your phone then I assume it's pretty basic and insecure.

Presenting this as a choice between using Apple's closed solution or using easy-to-remember passwords is disingenuous. Please don't participate in the discussion if you're going to be this bad faith.

> Please don't participate in the discussion if you're going to be this bad faith.

That works both ways. You've asked a question, to which the information is easily accessible online[https://support.apple.com/en-gb/HT213305]. It very clear from both the article and other online sources that this is based on WebAuthN[https://webauthn.guide]. You have been equally as disingenuous and based on your responses, acted in bad faith from the beginning in a bid to start a flamewar. How what you are doing is anything but basic bullying is beyond me.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#55

Post by iggldiggl »

cm2187 wrote: post #44
threeseed wrote: post #30

Earlier quoted context omitted.

I worked at Apple and no one is deliberately making the experience bad on non-Apple devices. They just have a million things they want to do, limited resources and so they simply don't prioritise it.

The developers of iTunes for windows certainly do. I wrote developers because I assume there is more than one, but I guess that number may be 1 or 0.

I find not having to contend with the break-up of iTunes into a gazillion of separate apps (so far, fingers crossed) to actually be an advantage of using it on Windows these days.

That's because I prefer to manage my collection of radio comedy episodes as podcasts [1], and with unified iTunes that's simply a matter of changing the media type of those files to "Podcast" and voila, it just works. On a modern Mac on the other hand, from what I've gathered this is no longer possible, and the separate Podcasts app that has replaced iTunes in that regards only supports subscribing to "real" podcasts, and doesn't allow manually adding additional episodes. (I suppose I'd have to resort to either hacking the local podcast database, or set up a local HTTP server with a fake podcast feed in order to add those files, or just give up on that prospect entirely…)

[1] So they don't clutter up my actual music library, to get the listened/unlistened visual indicator, and due to way I'm syncing iTunes with my Android phone, to also get my phone to remember the playback position, too (in iTunes you can enable remembering the playback position for any file, including music tracks, but my Android media player nevertheless only supports this for files synced over as "podcasts").

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#56

Post by zorrolovsky »

webmobdev wrote: post #53

Passkeys are designed to take away further control from you and that is why BigTech are promoting it. Do you really want to tie your digital life to a device?

I share that view.

From a usability perspective, Apple's approach is great. From a privacy rights perspective... it's very bad.

It has been proven that big tech firms are in bed with govs, and allow them to violate citizen's rights at their convenience. Is it a good idea to trust them with all your data, accounts, etc? Hell, no.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#57

Post by PartiallyTyped »

webmobdev wrote: post #53

Passkeys are designed to take away further control from you and that is why BigTech are promoting it. Do you really want to tie your digital life to a device?

> Do you really want to tie your digital life to a device?

Already true for many people.

There will be passwordless alternatives given that BitWarden is investing in the tech[1] .

[1] https://bitwarden.com/blog/accelerating-value-for-bitwarden-...

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#59

Post by Hamcha »

kleiba wrote: post #58

Honest question since I'm not in the loop: what is the problem with passwords that passkeys are trying to solve?

Passwords can be reused and stored on remote servers, if one is compromised, those password are now out there. Passkeys are asymmetric so the actual key is only stored in your keychain and the UX basically prevents reuse

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#60

Post by thealistra »

sunaurus wrote: post #37
red_admiral wrote: post #34

Earlier quoted context omitted.

FIDO authentication, of which webauthn is the successor, works like this: your secret is a signing key for a digital signature cryptosystem. When you authenticate, it signs a message containing various things including the hostname of the site being authenticated to, and because this is under the control of the browser, a phishing site can't fake it easily (also the browser will throw a fit if you're not on https). T…

I was more worried about attacks where the attacker takes a screenshot of the QR code and sends it to the user while pretending to be a support agent. So the user never even opens any evil site in their browser.

Scanning a qr code triggers a bluetooth bridge to continue. If a scammer or your mom scans it from someplace else, it won’t work. Good for antiphishing. Bad for oops, left phone at home.
Post reply on HN