Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple passwords deserve an app

cabel.com

Post reply on HN
Print view View original

231–240 of 414 posts

Re: Apple passwords deserve an app

#231

Post by great_psy »

lxgr wrote: post #220
great_psy wrote: post #209

Earlier quoted context omitted.

Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code

The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device. They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys. I'm not sure if having a recovery code would improve that situation, but…

Ah ok, yes the shoulder surfing is definitely a problem.

Hard to mitigate somebody looking over your shoulder, this is the case with most password managers, but I understand why this is a more likely scenario.

Re: Apple passwords deserve an app

#232

Post by squeaky-clean »

reaperducer wrote: post #35
cjdoc29 wrote: post #2

I really like Apple's implementation of passwords, passkeys, etc. But...I had a hard time explaining this to my mom. She uses it to generate her passwords and fill-in within Safari which is great! But there's no "Passwords" app, and she didn't know to go into Settings to reference a password when Safari doesn't recognize a password field (probably the website's fault). 2FA is also a confusing experience, but 2FA is a…

But there's no "Passwords" app It's called Keychain Access.

Isn't Keychain Access MacOS only? It's not available on iPhone.

Re: Apple passwords deserve an app

#233

Post by gumby »

The nice thing is: the way they implemented this it looks like you could pretty easily write a 1passwordish mac client as an interface to the system infrastructure. I say "1passwordish" because one of the tedious part of a program like that is the browser parsing to handle all the weird authentication cases devs write.

Unfortunately I'm not an ios dev and wonder if it might even be possible to do the same on ios? I believe there is an API so you can write a password manager (1password et al use that) but can you get to the secure system services?

Edit: I now see who wrote this blog post. Were it straightforward on ios he probably would have said so.

Re: Apple passwords deserve an app

#234

Post by ajmurmann »

hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

"If you are 100% Mac then it's a good product."

I use 100% ma except for gaming. However, I use other browsers as well, so the coupling to Safari is a deal breaker.

Re: Apple passwords deserve an app

#235

Post by frutiger »

gumby wrote: post #233

The nice thing is: the way they implemented this it looks like you could pretty easily write a 1passwordish mac client as an interface to the system infrastructure. I say "1passwordish" because one of the tedious part of a program like that is the browser parsing to handle all the weird authentication cases devs write. Unfortunately I'm not an ios dev and wonder if it might even be possible to do the same on ios? I b…

I am not an expert macOS/iOS developer but I unsuccessfully played around with the API a couple of times.

You can’t access passwords stored by another app (app identifiers appeared to be globally unique, e.g. com.apple.Safari). There was an additional hurdle to access/store items in the iCloud keychain, though I forget what exactly.

This restriction makes sense.

Re: Apple passwords deserve an app

#236

Post by alexjm »

mcculley wrote: post #217
hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> 3. The GUI is buried in System Settings. Heaven forbid you need search it's only a simple 37 clicks away! I just learned that this GUI exists. I have been using /System/Applications/Utilities/Keychain Access.app for years to deal with passwords.

Same. And now I'm trying to figure out if there's any advantage to using the UI in System Settings instead of the app I already know.

Re: Apple passwords deserve an app

#237

Post by musicale »

klodolph wrote: post #185
yamtaddle wrote: post #151

Earlier quoted context omitted.

> 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. Like a lot of other Apple stuff, I'm only able to use it because I don't use anything non-Apple for anything "serious" that involves a GUI. Windows is for gaming, Linux is my file storage and docker-service-running server that I only interact with over SSH and Web. Ditto Notes, all their Office-type progra…

> Yeah, this is super fucking weird. You'd think this would be connected in some fashion to "keychain", but nope. Other browsers used to be able to use it. I do think it’s a really thorny issue—“allow this application to access all saved passwords?” is a pretty damn scary permission to include. Up there with the “allow this application to control your computer” permission that is used for accessibility apps (which ap…

> allow this application to access all saved passwords

I'd like to see finer granularity, perhaps multiple web password vaults and a mechanism to allow certain browsers to use certain vaults.

It might also be nice to specify which passwords could be accessed with which kind of authentication. Unfortunately the current system password dialog is easily spoofable - it really looks like a questionable javascript popup.

Re: Apple passwords deserve an app

#238

Post by muhammadusman »

I resisted using 1Password for a long time but then once I got into the 1P world, it was better than all the alternatives. LastPass is unsafe, Dashlane has subpar experience, and all the proprietary ones are missing tons of features.

Chrome, Firefox, Apple, I'm sure Windows too, have all their own password managers and all of them are hard to use and expect you to only have devices in their ecosystem.

1Password is worth every penny for how well they've kept up with updating their apps and their prevalence on all platforms. And the 2FA integration is great too!

Re: Apple passwords deserve an app

#239

Post by fitzroy »

hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

I use this Menubar short cut for Passwords, so it's only 2 clicks and fingerprint away.

https://www.icloud.com/shortcuts/22133925f3e34579b22951d6593...

Re: Apple passwords deserve an app

#240

Post by m000 »

ElijahLynn wrote: post #40

One problem with that is if a person has a non-Apple product, Apple won't build the app cross-platform, so they are even further locked into Apple hardware then. Might not affect that many people. But it would surely limit choice for those who don't even know about the lock-in later in their lives.

Any attempted lock-in is guaranteed to attract attention of EU regulators.

This is what Apple probably wants to avoid. They won't be allowed to play a "Safari" this time (i.e. all password managers are allowed, as long as they are a frontend to our own password manager).

Also, having the password manager as a separate app, it is likely they will be asked to provide a standalone password migration API for third party password managers. This would make switching to another ecosystem trivial for moms & pops, who currently need to deal with CSV import & export* if they want to move their passwords out of iCloud.

* Not sure what the situation is ATM, but a few years back exporting passwords from iCloud was not directly supported. I had to run a third-party AppleScript script to generate a CSV to import in another password manager.

Post reply on HN