Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple passwords deserve an app

cabel.com

Post reply on HN
Print view View original

211–220 of 414 posts

Re: Apple passwords deserve an app

#211

Post by zarzavat »

stouset wrote: post #179
rootusrootus wrote: post #66

Earlier quoted context omitted.

I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.

Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts. Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Pas…

I’m super curious what a backup second factor is for the average user who has only one device: a phone, that sometimes gets lost or is stolen.

Feels like these things are designed by Californians with no idea of how the world is.

Re: Apple passwords deserve an app

#212

Post by knodi123 »

yamtaddle wrote: post #151
hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. Like a lot of other Apple stuff, I'm only able to use it because I don't use anything non-Apple for anything "serious" that involves a GUI. Windows is for gaming, Linux is my file storage and docker-service-running server that I only interact with over SSH and Web. Ditto Notes, all their Office-type progra…

> The fucking name of the screen is "passwords"! I shouldn't have to get farther than "pas" for it to be the first entry on the list, "pass" in the worst-case!

Weird. "pas" and it was top of the list for me.

Re: Apple passwords deserve an app

#213

Post by wmeredith »

hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired.

This has been the Apple way since the 1980's

Re: Apple passwords deserve an app

#214

Post by r0m4n0 »

I think a few problems imho:

1)they don’t do cross platform software well so they would never make a windows app, chrome extension, android integration etc. It’s either all or nothing which I would never buy into (even as an iPhone and mbp user)

2) there are actually a ton of use cases here that make the software actually very complex and high stakes. I’d wager the pros don’t outweigh the cons. Also apple isn’t known for complex software with niche use cases. Honestly their current safari/iphone password manager is trash

They do a few things well and rely on lock-in and ecosystem

Re: Apple passwords deserve an app

#215

Post by waboremo »

porcoda wrote: post #63
waboremo wrote: post #27

Earlier quoted context omitted.

Funny situation, there's another thread I was replying to someone who wanted to shift back to native apps instead of cross plat electron apps (for performance reasons). Well, Apple Passwords on Windows is a good example of how that turns out in reality. I believe it's using WinUI. While the performance is nice, the experience is entirely unlike what you get on Mac and winds up making you wish you were using another s…

This has been the story of Apple apps outside MacOS forever: they appear to always do the absolute minimum to claim support, and you end up with a super clunky windows app that is terrible. I doubt they’d do much better using electron: I think their development model is that if it isn’t on one of their platforms, they pump out a minimum-effort, low quality app. I’d guess that electron ones would be just as clunky, ex…

That hasn't really been true. Apple supported iTunes and Safari which were great options on Windows. Not just "I'm already an Apple fan so I have to use it", but actively deciding to use them.

The root of the problem for Apple is that they cannot get away with doing what they used to in the past, they already have a plethora of platforms within their own umbrella to support, adding Windows native to the mix seems to result in maybe a handful of developers taking on enormous burdens by trying to catch up to their expected Mac apps.

If Apple were to seriously put its weight behind a cross-platform toolkit, this might change, especially as they want their services to grow. It's the very reason why their main service competitors can even compete.

But I agree that if they were to suddenly switch to Electron without a care it wouldn't turn out well, but likely have a better end user experience than their current reveals.

Re: Apple passwords deserve an app

#216

Post by stouset »

zarzavat wrote: post #211
stouset wrote: post #179

Earlier quoted context omitted.

Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts. Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Pas…

I’m super curious what a backup second factor is for the average user who has only one device: a phone, that sometimes gets lost or is stolen. Feels like these things are designed by Californians with no idea of how the world is.

If you're in this category, your alternative to Passkeys at all is SMS or no 2FA whatsoever. Enabling Passkeys does at least ensure that you have a minimum of two separate devices so you already do effectively have some form of backup of your second factor.

My comment is targeted at someone who is savvy enough to: a) care about having "real" 2FA, and b) is concerned about lock-in, and c) is extremely sensitive to being locked out. For someone like that, you're already buying YubiKeys or some equivalent. And if you don't already have some, you're never prevented from using them later.

Re: Apple passwords deserve an app

#217

Post by mcculley »

hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> 3. The GUI is buried in System Settings. Heaven forbid you need search it's only a simple 37 clicks away!

I just learned that this GUI exists. I have been using /System/Applications/Utilities/Keychain Access.app for years to deal with passwords.

Re: Apple passwords deserve an app

#218

Post by stouset »

jorvi wrote: post #203
stouset wrote: post #179

Earlier quoted context omitted.

Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts. Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Pas…

Isn’t the whole point of Passkeys that you can’t ever lose them, since they’re tied to your biometrics..

They're not tied to your biometrics. They're stored inside the TPM of your device, which is unlocked by some form of biometrics.

But if you lose all the devices with your passkeys on them, they are gone for good.

Re: Apple passwords deserve an app

#219

Post by great_psy »

rpgbr wrote: post #156
great_psy wrote: post #114

Earlier quoted context omitted.

We can use the same argument for any other cloud password manager. If google/Apple blocks my access, well it’s those services I am trying to log into in the first place so the point is moot. Also I have recovery keys for the more important accounts printed and stored in a safe box.

Except password managers that YOU need to take care your vault, like KeePassXC.

I used keePass before LastPass, but the issue was with keeping the file synced. I had it in Dropbox and I was able to open it no problem from the phone, but making updates from phone was a challenge. Maybe I was not using a good app but it was a hassle to keep it synchronized.

But anyway, somebody could cut off your access to Dropbox, but it’s less of an issues since you have a backup.

Re: Apple passwords deserve an app

#220

Post by lxgr »

great_psy wrote: post #209
lxgr wrote: post #201

Earlier quoted context omitted.

Absolutely. Given these reports, Apple's security model isn't close to being sophisticated enough to warrant trusting them with passwords or (even more critically, arguably) WebAuthN passkeys. I recently saw it with my own eyes as a family member was able to reset their iCloud password and gain full access to their account on a new device, including iCloud Keychain, using nothing but their iPad and the corresponding…

Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code

The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device.

They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys.

I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.

Post reply on HN