Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently uploads your passwords and keeps them

lapcatsoftware.com

Post reply on HN
Print view View original

121–130 of 130 posts

Re: Apple silently uploads your passwords and keeps them

#121

Post by EasyMark »

lapcat wrote: post #66

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In…

wouldn't you assume that if you log into a machine with your apple "cloud" credentials that various programs would sync up? I don't see how it could happen any other way? It would be nice if they had a pop up like they do for app permissions though. Perhaps submit a radar on it as a regular user? https://lickability.com/blog/5-tips-for-filing-radars/

Re: Apple silently uploads your passwords and keeps them

#122

Post by EasyMark »

squidgedcricket wrote: post #81
falcolas wrote: post #79

Earlier quoted context omitted.

So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.

You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.

Why wouldn't you use local solutions for that? There is no profitability in that for companies and a lot of headaches to maintain another solution that they are just going to see as a money-sink. Companies pretty much -have- to provide a password solution on a modern OS, but they don't have to provide 2. It will have to be done by you with something like KeepassXC or Vaultwarden or something.

Re: Apple silently uploads your passwords and keeps them

#123

Post by EasyMark »

mafuy wrote: post #105
falcolas wrote: post #79

Earlier quoted context omitted.

So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.

I think firefox asked me what I want to sync

It does, and you can configure it at any point, per browser, but it's just a click box. Someone could come in behind you and click on password I think to sync up passwords. Maybe it should ask for your sync password if you do that? It doesn't seem to right now, I just changed it with no complaints. That said I only keep unimportant passwords in firefox as a convenience, banking etc go in bitwarden

Re: Apple silently uploads your passwords and keeps them

#124

Post by retrochameleon »

EasyMark wrote: post #121
lapcat wrote: post #66

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In…

wouldn't you assume that if you log into a machine with your apple "cloud" credentials that various programs would sync up? I don't see how it could happen any other way? It would be nice if they had a pop up like they do for app permissions though. Perhaps submit a radar on it as a regular user? https://lickability.com/blog/5-tips-for-filing-radars/

No. Not without allowing me to configure what gets synced and what does not.

Re: Apple silently uploads your passwords and keeps them

#125

Post by VMtest »

netdevnet wrote: post #60
VMtest wrote: post #45

Earlier quoted context omitted.

I am not sure if you are ignorant or what, but GP obviously means someone else other than Apple

It means Apple. See: "Are you sure Apple can’t read them too?". Next time you insult someone, better use your cognition powers to avoid looking like that which you call others

My bad, I didn't mean to insult you. I meant it as a criticism

By GP, u/blitzar's comment, my cognition tells me that his comment meant anyone can break AES 256-bit encryption, including Apple, but in this context, he could have meant everyone else

Re: Apple silently uploads your passwords and keeps them

#126

Post by eadmund »

lapcat wrote: post #100
mcsniff wrote: post #98

Earlier quoted context omitted.

The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission.

> The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission. Why are you being repeatedly, needlessly pedantic? Everyone knows what I meant (including you, who chose to misinterpret). Your other comment was also pointless: "that's still choosing Mac over Linux and every day you continue to make that choice." https://news.ycombinator.com/item?id=42016888 You…

I don’t think that’s a terribly kind response. There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means.

I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice.

Those may all be defensible choices. They may even be correct. But they’re still choices.

In your particular case, given that you appear to support yourself by selling iOS apps, it probably makes sense to keep using Apple devices. Retraining to write software running on Linux would be work. And few Linux users would buy software anyway.

But if you ever get tired of using OSes you can’t control on devices you can’t control, and want to write software to do what you want, you might want to come on over to Linux. It’s pretty fun!

Re: Apple silently uploads your passwords and keeps them

#127

Post by lapcat »

eadmund wrote: post #126
lapcat wrote: post #100

Earlier quoted context omitted.

> The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission. Why are you being repeatedly, needlessly pedantic? Everyone knows what I meant (including you, who chose to misinterpret). Your other comment was also pointless: "that's still choosing Mac over Linux and every day you continue to make that choice." https://news.ycombinator.com/item?id=42016888 You…

I don’t think that’s a terribly kind response. There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means. I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after App…

> There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means.

No, it's not what the word meant. What a word means depends on context. If I had simply said, "The good news is that the device was in my home under my observation", then the commenter "mcsniff" would have no opportunity to go off on a rant about "ownership" and "control". Or maybe you're going to argue pedantically that it's not "my" home, because I'm a renter? Or would you argue with someone with a mortgage that it's not "your" home, it's the bank's home? That's just pointless pedantry that clarifies nothing and benefits nobody.

> I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice.

Everything is a choice. Therefore it's a tautology and adds zero to the conversation. Your comment was a choice. My comment is a choice. Choice choice choice choice. So what?

Re: Apple silently uploads your passwords and keeps them

#128

Post by neuralRiot »

lapcat wrote: post #66

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In…

I don’t know if it’s true but when backing up locally via Itunes it warns you that if you don’t encrypt the backup, passwords won’t be saved. I don’t save backups on icloud.

Re: Apple silently uploads your passwords and keeps them

#129

Post by musicale »

musicale wrote: post #116
InMice wrote: post #99

The most obnxious aspect of owning an iphone for me. Apple turns icloud syncing on by default for everything, not just password management. Photos, browsing history etc. there should be an account setting that lets you turn this off completely no matter what device you sign into with your icloud account. Completely obnoxious, my icloud photos is a total mess of triple and double copies of photos going back decades i…

I hate default on for cloud sync. It should be opt-in.

To clarify, Apple is often good about requiring opt-in for a bunch of features, especially privacy-related features, and I appreciate that. Unfortunately there are some annoying corner cases, such as having to manually disable iCloud sync for photos (etc.), or the issue that OP ran into with having iCloud keychain re-enable itself after being turned off. It also used to be easier to actually turn off wi-fi and bluetooth without them reactivating automatically. I understand why they made it harder (to reduce complaints and support calls/appointments for AirDrop/AirPods/Apple watch/etc. not working due to user settings) but I would have preferred an alternative approach of making it simple and obvious how to fix any AirDrop or other issues while preserving the ability to easily turn off wi-fi.

Re: Apple silently uploads your passwords and keeps them

#130

Post by robertlagrant »

cassianoleal wrote: post #21
robertlagrant wrote: post #16

Earlier quoted context omitted.

I'm not sure I've used any operating system where I have more privilege than the kernel does.

You can escalate your privilege if you can freely choose which kernel to run. Maybe you won’t have _more_ privilege than the kernel but you would certainly have as much.

I can escalate my privilege to be higher than the kernel's?
Post reply on HN