Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently uploads your passwords and keeps them

lapcatsoftware.com

Post reply on HN
Print view View original

71–80 of 130 posts

Re: Apple silently uploads your passwords and keeps them

#71

Post by tonyedgecombe »

lapcat wrote: post #62
threeseed wrote: post #57

Earlier quoted context omitted.

There is a separate iCloud Keychain so you can just copy to your local one. Or use the Export All Passwords feature in the Passwords app.

> There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't…

>I want to use the operating system to store my passwords locally. I just don't want them in iCloud.

Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac

Re: Apple silently uploads your passwords and keeps them

#72

Post by [deleted] »

avazhi wrote: post #13
Veen wrote: post #3

This may be annoying, but it’s uploading encrypted versions of passwords, not passwords themselves. Keychain is end-to-end encrypted so no one else can read them.

If they are uploading the PW and not the hash then… they are uploading the passwords themselves, encrypted or not. And guess who has the decryption keys…?

[deleted]

Re: Apple silently uploads your passwords and keeps them

#73

Post by thejazzman »

lapcat wrote: post #62
threeseed wrote: post #57

Earlier quoted context omitted.

There is a separate iCloud Keychain so you can just copy to your local one. Or use the Export All Passwords feature in the Passwords app.

> There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't…

If you open the keychain app on a Mac you can clearly see the existence of multiple keychains and one explicitly labeled iCloud

iCloud only stores passwords when you're logged into iCloud. Logout and you're local only.

Would it be nice to have no configuration and customization? Sure. People have felt that way for as long as I can remember.

Re: Apple silently uploads your passwords and keeps them

#74

Post by lapcat »

mcsniff wrote: post #70
lapcat wrote: post #19

Earlier quoted context omitted.

I didn't choose Mac over Linux. I chose Mac over Windows in the year 2002, and I became a Mac developer in 2006. Things were a lot different back then. Now it's too late for me, because my entire livelihood depends on Mac.

Not throwing shade here on your decision, but that's still choosing Mac over Linux and every day you continue to make that choice. It's a perfectly fine decision, but Linux was, and still is, an option for plenty of people who develop for Apple hardware/software without daily driving it, myself included.

> Linux was, and still is, an option for plenty of people who develop for Apple hardware/software without daily driving it, myself included.

Well, I believe in dogfooding. I don't think it would be good for my software or my customers if I didn't use the same operating system as them. Besides, work-related activities are mostly what I use a computer for, so I'm not sure what I would even do with Linux.

Re: Apple silently uploads your passwords and keeps them

#75

Post by lapcat »

tonyedgecombe wrote: post #69
lapcat wrote: post #66

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In…

> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.

> Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac

You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.

Re: Apple silently uploads your passwords and keeps them

#76

Post by lapcat »

thejazzman wrote: post #73
lapcat wrote: post #62

Earlier quoted context omitted.

> There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't…

If you open the keychain app on a Mac you can clearly see the existence of multiple keychains and one explicitly labeled iCloud iCloud only stores passwords when you're logged into iCloud. Logout and you're local only. Would it be nice to have no configuration and customization? Sure. People have felt that way for as long as I can remember.

> If you open the keychain app on a Mac

I've been using the Keychain app on the Mac for 20 years.

> you can clearly see the existence of multiple keychains and one explicitly labeled iCloud

There's no "iCloud" keychain if you don't use iCloud Keychain. There is a "Local Items" keychain. Let me emphasize LOCAL in the name. Unfortunately, what happens when iCloud Keychain is enabled (silently, without consent in my case), "Local Items" becomes "iCloud". macOS stores a lot of things in the Local Items keychain, including Safari web form passwords, which is why mine got silently uploaded to iCloud.

Re: Apple silently uploads your passwords and keeps them

#77

Post by lapcat »

tonyedgecombe wrote: post #71
lapcat wrote: post #62

Earlier quoted context omitted.

> There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't…

>I want to use the operating system to store my passwords locally. I just don't want them in iCloud. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac

Your copy-and-pasted reply is as wrong here as it was there: https://news.ycombinator.com/item?id=42016863

Re: Apple silently uploads your passwords and keeps them

#78

Post by mcsniff »

lapcat wrote: post #74
mcsniff wrote: post #70

Earlier quoted context omitted.

Not throwing shade here on your decision, but that's still choosing Mac over Linux and every day you continue to make that choice. It's a perfectly fine decision, but Linux was, and still is, an option for plenty of people who develop for Apple hardware/software without daily driving it, myself included.

> Linux was, and still is, an option for plenty of people who develop for Apple hardware/software without daily driving it, myself included. Well, I believe in dogfooding. I don't think it would be good for my software or my customers if I didn't use the same operating system as them. Besides, work-related activities are mostly what I use a computer for, so I'm not sure what I would even do with Linux.

You'd be more in control over having your passwords silently uploaded to a third party without your knowledge or consent, for starters.

Again, full respect for your decisions, but there are consequences to them and as your blog and experience shows, they are numerous and have serious impacts.

Re: Apple silently uploads your passwords and keeps them

#79

Post by falcolas »

lapcat wrote: post #75
tonyedgecombe wrote: post #69

Earlier quoted context omitted.

> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.

> Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.

So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.

Re: Apple silently uploads your passwords and keeps them

#80

Post by lapcat »

mcsniff wrote: post #78
lapcat wrote: post #74

Earlier quoted context omitted.

> Linux was, and still is, an option for plenty of people who develop for Apple hardware/software without daily driving it, myself included. Well, I believe in dogfooding. I don't think it would be good for my software or my customers if I didn't use the same operating system as them. Besides, work-related activities are mostly what I use a computer for, so I'm not sure what I would even do with Linux.

You'd be more in control over having your passwords silently uploaded to a third party without your knowledge or consent, for starters. Again, full respect for your decisions, but there are consequences to them and as your blog and experience shows, they are numerous and have serious impacts.

Me: work-related activities are mostly what I use a computer for, so I'm not sure what I would even do with Linux.

You: You'd be more in control over having your passwords silently uploaded to a third party without your knowledge or consent

If I mostly use a computer for work purposes, what do you think my passwords are for?

Also, I've been using a Mac since 2002, and iCloud Keychain got toggled on in 2024. It's kind of absurd to suggest, in 20/20 hindsight, that I should have expected it.

Post reply on HN