Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple passwords deserve an app

cabel.com

Post reply on HN
Print view View original

251–260 of 414 posts

Re: Apple passwords deserve an app

#251

Post by palata »

OsintOtter69 wrote: post #248
hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

Last pass had a major incident recently iirc.

I moved to Bitwarden right after it, and I can't believe how much better it is in terms of UX \o/. I whish I had made the move years earlier.

Re: Apple passwords deserve an app

#252

Post by xivzgrev »

hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

Also, if your phone is stolen / lost and someone can guess your 6 digit passcode, then all your passwords are exposed.

That was biggest deal killer for me.

Re: Apple passwords deserve an app

#253

Post by sholladay »

shortcake27 wrote: post #221
sholladay wrote: post #178

I don’t personally care much whether Passwords is in Settings or a separate app. But I do have one problem with it. As far as I can tell, you must save a password for a site in order to use the TOTP 2FA feature. I don’t want my device filling in passwords for me because it defeats the purpose of a password being “something I know”. The 2FA code is more like “something I have” and I’m okay with the device filling that…

The “something you know” is your devices pincode/passcode/iCloud password, not the password to the website. If you know the password to a website it means you’re reusing passwords or using a pattern to generate passwords, both of which are less secure than randomly generated passwords (especially the former). Of course, nothing is stopping you from saving a bogus password either.

I don’t buy it. Complex, random passwords are great against brute force attacks but that’s not usually how these things play out.

Many password breaches are caused by technical lapses on the part of a platform, where password complexity often becomes irrelevant. Your password gets hovered up along with everyone else’s and eventually gets decrypted, and tried en masse against other platforms. In this scenario, even a simple pattern for passwords is probably enough to prevent the problem from spreading, as long as it’s not too obvious.

The other way passwords often get compromised is from someone looking over your shoulder or key logging, infrared on PIN pads, etc. In this scenario, your system is WAY, WAY worse, since one password unlocks the kingdom, and that password is frequently being used.

As it stands, if someone peeks over my shoulder and discovers my phone password, then steals my phone, it’s damaging but not game over. They can’t access any websites.

If I allow my phone password to be the only gatekeeper to access everything, IMO that’s lousy security.

Re: Apple passwords deserve an app

#254

Post by OsintOtter69 »

AdmiralAsshat wrote: post #8
hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working as designed."

[flagged]

Re: Apple passwords deserve an app

#255

Post by rohan_ »

fckgw wrote: post #150
rohan_ wrote: post #54

>(And it all syncs across your devices, for free?!) IMO the worst part about apple keychain is they can't be used with Chrome (the most common browser for mac!)

You can, Apple has an extension for iCloud Keychain. https://chrome.google.com/webstore/detail/icloud-passwords/p...

Windows only

Re: Apple passwords deserve an app

#256

Post by waboremo »

paulryanrogers wrote: post #244
waboremo wrote: post #215

Earlier quoted context omitted.

That hasn't really been true. Apple supported iTunes and Safari which were great options on Windows. Not just "I'm already an Apple fan so I have to use it", but actively deciding to use them. The root of the problem for Apple is that they cannot get away with doing what they used to in the past, they already have a plethora of platforms within their own umbrella to support, adding Windows native to the mix seems to…

So SwiftUI for Windows?

Would be very interesting!

Re: Apple passwords deserve an app

#257

Post by keyle »

yamtaddle wrote: post #151
hnrodey wrote: post #4

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven fo…

> 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. Like a lot of other Apple stuff, I'm only able to use it because I don't use anything non-Apple for anything "serious" that involves a GUI. Windows is for gaming, Linux is my file storage and docker-service-running server that I only interact with over SSH and Web. Ditto Notes, all their Office-type progra…

>> 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable.

> Yeah, this is super fucking weird. You'd think this would be connected in some fashion to "keychain", but nope

No it's not. I don't want some exotic product connect to a domain I have passwords in and prompting me for access. The password should be tied to the product you used to login with.

This is a misunderstanding of keychain vs. lastpass. One is designed to remember "safari passwords" or any swift/cocoa application implementing keychain. One key feature is: once stored in Keychain this information is only available to your app, other apps can't see it.

Lastpass and other similar products are designed as a data warehouse / vault for you security items. From there, plugins in browsers etc. can take over.

I will totally agree with the fact that the GUI is frustrating at best.

Re: Apple passwords deserve an app

#258

Post by Gigachad »

matt-attack wrote: post #126
dwaite wrote: post #80

Earlier quoted context omitted.

Not just that, they will detect QR code images to work around sites which assume that TOTP is only available by scanning your desktop screen from your phone.

Can you provide an example website that uses this technology? Not sure I've ever encountered one.

Uh, basically all of them? They all show a QR code and never show you the secret which you could copy in to your password manager.

Re: Apple passwords deserve an app

#259

Post by rrsmtz »

eastbound wrote: post #242
amluto wrote: post #224

Earlier quoted context omitted.

In Spotlight, I need “passw” to see it. In the actual Settings search, I also need “passw”, and that only gets it to #5 in the list. Also, Spotlight is bizarrely slow finding even local apps and things like Passwords. WTF

Did you tell it to ignore most local files?

Wow! Just discovered the Spotlight customization and it is so much faster and more useful when you remove certain locations and turn off definitions and Siri suggestions.

Re: Apple passwords deserve an app

#260

Post by jtbayly »

ellisv wrote: post #146
monocularvision wrote: post #141

Am I the only person on Earth that needs sharing of passwords among my family? Any time folks bring up password solutions, they are always missing this requirement for me. 1Password is a life-saver in this regards. All my kids have their own vaults but for the little ones I have them use a shared vault between my wife and me so we have access to their passwords. I can also easily share passwords for services like Net…

I agree that is one of the big issues with keychain. You can share keychain items with people but it is awkward.

Are you referring to Airdrop password and passkey sharing?[1] That’s the only way I can find other than manual copy/paste.

Also, I very much doubt if I later change the password I shared via Airdrop that it will update on the other person’s device… which is half the point.

[1]: https://support.apple.com/guide/iphone/share-passkeys-passwo...

Post reply on HN