Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently uploads your passwords and keeps them

lapcatsoftware.com

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Apple silently uploads your passwords and keeps them

#81

Post by squidgedcricket »

falcolas wrote: post #79
lapcat wrote: post #75

Earlier quoted context omitted.

> Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.

So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.

You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook.

It's not the happy path though. We need a tech a company that prioritizes local-first designs.

Re: Apple silently uploads your passwords and keeps them

#82

Post by falcolas »

squidgedcricket wrote: post #81
falcolas wrote: post #79

Earlier quoted context omitted.

So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.

You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.

At least with Chrome (and stock chromium, IIRC), you don't have to sign into the browser. If you sign into any Google property, the browser will use that auth to log you in.

Firefox does not, but it sure prompts the hell out of you to do so.

Re: Apple silently uploads your passwords and keeps them

#83

Post by kstrauser »

hello0904 wrote: post #26
blitzar wrote: post #18

Earlier quoted context omitted.

Are you sure AES 256-bit hasn't been broken?

Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. AES is not one way and in theory you can generate 2nd, 3rd, etc. master keys to decrypt. :)

A thought experiment:

Use Argon2 to hash a password before storing it in the password manager. Now the user visits that website and wants to log in. What is it that the password manager pastes into the login form?

Answer: the plaintext password. But how do you get that out of the hashed value you stored earlier? You don’t. Ergo, password managers cannot use hashing functions to store their contents.

Re: Apple silently uploads your passwords and keeps them

#84

Post by SoftTalker »

lapcat wrote: post #75
tonyedgecombe wrote: post #69

Earlier quoted context omitted.

> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.

> Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.

I disabled all iCloud stuff the first day I had my iPhone. Just checked and it's still off.

Re: Apple silently uploads your passwords and keeps them

#85

Post by SoftTalker »

stouset wrote: post #37
a2128 wrote: post #4

Earlier quoted context omitted.

Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no

If you don’t want it, don’t store your passwords in it?

Yep. Disabling password storage is one of the first things I do when setting up a browser on a new computer.

Re: Apple silently uploads your passwords and keeps them

#86

Post by lapcat »

falcolas wrote: post #82
squidgedcricket wrote: post #81

Earlier quoted context omitted.

You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.

At least with Chrome (and stock chromium, IIRC), you don't have to sign into the browser. If you sign into any Google property, the browser will use that auth to log you in. Firefox does not, but it sure prompts the hell out of you to do so.

In Chrome Settings, You and Google, Sync and Google services, there's a toggle "Allow Chrome sign-in", which says "By turning this off, you can sign in to Google sites like Gmail without signing in to Chrome".

Re: Apple silently uploads your passwords and keeps them

#87

Post by falcolas »

lapcat wrote: post #86
falcolas wrote: post #82

Earlier quoted context omitted.

At least with Chrome (and stock chromium, IIRC), you don't have to sign into the browser. If you sign into any Google property, the browser will use that auth to log you in. Firefox does not, but it sure prompts the hell out of you to do so.

In Chrome Settings, You and Google, Sync and Google services, there's a toggle "Allow Chrome sign-in", which says "By turning this off, you can sign in to Google sites like Gmail without signing in to Chrome".

Sure. But it's on by default, isn't it? Just like Apple's upload is on by default.

Also, chromebooks require such a sign-in as well, and I'll bet they enable that syncing by default as well.

Singling out Apple here is kinda silly when they're encrypted (if you don't trust Apple to tell the truth there, running their OS at all is risky), and when the behavior is that which we'd expect.

And at the end of the day, using Apple's password manager is mostly (exceptions including wifi passwords) optional.

Re: Apple silently uploads your passwords and keeps them

#88

Post by lapcat »

falcolas wrote: post #87
lapcat wrote: post #86

Earlier quoted context omitted.

In Chrome Settings, You and Google, Sync and Google services, there's a toggle "Allow Chrome sign-in", which says "By turning this off, you can sign in to Google sites like Gmail without signing in to Chrome".

Sure. But it's on by default, isn't it? Just like Apple's upload is on by default. Also, chromebooks require such a sign-in as well, and I'll bet they enable that syncing by default as well. Singling out Apple here is kinda silly when they're encrypted (if you don't trust Apple to tell the truth there, running their OS at all is risky), and when the behavior is that which we'd expect. And at the end of the day, using…

> Just like Apple's upload is on by default.

The blog post is about how it was off and then got silently toggled on.

> Singling out Apple here

I'm not a journalist covering tech companies. I'm an Apple user complaining about something that happened on my own Apple devices. It's silly to characterize that as "singling out Apple".

I do use Chrome, though, and it never silently switched that toggle back on. If it did, I'd definitely blog about that.

Re: Apple silently uploads your passwords and keeps them

#89

Post by axoltl »

betimsl wrote: post #48

They probably encrypt the export with some kind of hash that is then securely transported to the new machine, decrypt it and import. Maybe someone can reverse engineer, attach a debugger and confirm, or analyze the traffic with a Transparent MITM Proxy on the new machine. Just grep for your password in the traffic captured, should be easy. And then write a blog post about that. Let's see what happens.

Or you could read their published security guide at https://help.apple.com/pdf/security/en_US/apple-platform-sec...

For the May 2024 version the section on iCloud Keychain is on page 158.

Re: Apple silently uploads your passwords and keeps them

#90

Post by npteljes »

lapcat wrote: post #66

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In…

>[manufacturer] deprived me of a choice in this case

This seems to be the industry trend with these remotely managed machines, like Apple or Windows PCs. The update mechanism, for better or worse, takes power from the user and assigns it back to the manufacturer / service provider. It's something that the software world would have considered a Trojan horse some 20 years ago, an extension of control to the end users machine, for someone other than the end user themselves.

I'm not sure where I'm going with this. What's for sure is that the IT zeitgeist really changed over the decades.

Post reply on HN