3 ms·

Maciej, do you consider the built in keychain functionality of iOS/MacOS to be a "password manager"? I only ask because I typically have found that when setting

by po 7y ago

Maciej, do you consider the built in keychain functionality of iOS/MacOS to be a "password manager"? I only ask because I typically have found that when setting up non-technical people with iPhones or new laptops, that it has recently passed the bar of 'easy enough for non technical people'. True, it can be hard to get to the stored passwords for manual entry and it doesn't work with a few sites, but generally speaking it picks random passwords, saves them fairly reliably and prompts to use them with biometric protection.

idlewords 7y ago
Yeah, for sure. If people were already using it, I gave them a thumbs up. In my mind it occupies some middle ground between a password manager and "I keep my passwords in this note app", but only because it doesn't tie in to Chrome.
- skybrian 7y ago
  What do you think about Chrome's built-in password management?
  - coredog64 7y ago
    One flaw for people who aren’t political campaigns is that frequently you’ll need to log in to something that’s not using a browser window. After years of headaches and literal tears, I broke down and bought LastPass for my kids. My wife isn’t technical, and I would come home to kids that had lost/forgotten their Minecraft password. They took it out on their mom, so instead of post-work no-tech downtime, I was coming home to Sev1 incidents that were already out of SLA.
- po 7y ago
  Ah yeah I forgot that your strategy revolved around Chrome due to the Yubi keys. Each browser offers a critical feature: cross device password management vs. easy hardware 2FA. I have a feeling Apple sees their iOS devices as Yubi keys and Google doesn't want chrome reading/writing to a 3rd party keychain. Not a great situation.
shakna 7y ago
Keychain is a decent enough password manager, but there are some considerations you have to make if you're deciding whether you want it to be your default. + It uses Triple-DES encryption. This is probably not enough when it comes to a political campaign. It can be broken with commodity hardware. 3DES has a lot of collision attacks against it, and is deprecated in most software, and NIST consider it to only be effectively around 80-112bits. + It doesn't encrypt all your data fields. Only the password or Secure Note is encrypted. Other fields like URL are in plain text, which may leak enough information to be sensitive, depending on what you consider sensitive. + However, on iOS, Keychain items are only accessible to the app that generated them, which is a huge plus. + It can sync across devices easily, because of iCloud integration, which is great for usability, but with weak encryption means if someone gains access to your iCloud, those passwords may be gone.
- walterbell 7y ago
  Are there technical reasons preventing Apple from addressing these weaknesses? Or is the native password manager deliberately weaker to enable 3rd-party apps?
  - shakna 7y ago
    I'm not qualified to answer. I'm hoping someone else can chime in. I was somewhat surprised that it's still using 3DES. However, a perusal through what I believe is the latest source [0] shows me the latest updates (that I could find) where in 2010 - when 3DES was still widely used, and considered by most to be fairly secure. (Flaws were mostly revealed in 2014, and the complete exploits came in 2017). [0] https://opensource.apple.com/source/libsecurity_keychain/libsecurity_keychain-55050.9/lib/ https://opensource.apple.com/source/libsecurity_keychain/lib...

by po 7y ago

idlewords 7y ago

Yeah, for sure. If people were already using it, I gave them a thumbs up. In my mind it occupies some middle ground between a password manager and "I keep my passwords in this note app", but only because it doesn't tie in to Chrome.

skybrian 7y ago
What do you think about Chrome's built-in password management?
- coredog64 7y ago
  One flaw for people who aren’t political campaigns is that frequently you’ll need to log in to something that’s not using a browser window. After years of headaches and literal tears, I broke down and bought LastPass for my kids. My wife isn’t technical, and I would come home to kids that had lost/forgotten their Minecraft password. They took it out on their mom, so instead of post-work no-tech downtime, I was coming home to Sev1 incidents that were already out of SLA.
po 7y ago
Ah yeah I forgot that your strategy revolved around Chrome due to the Yubi keys. Each browser offers a critical feature: cross device password management vs. easy hardware 2FA. I have a feeling Apple sees their iOS devices as Yubi keys and Google doesn't want chrome reading/writing to a 3rd party keychain. Not a great situation.

shakna 7y ago

Keychain is a decent enough password manager, but there are some considerations you have to make if you're deciding whether you want it to be your default. + It uses Triple-DES encryption. This is probably not enough when it comes to a political campaign. It can be broken with commodity hardware. 3DES has a lot of collision attacks against it, and is deprecated in most software, and NIST consider it to only be effectively around 80-112bits. + It doesn't encrypt all your data fields. Only the password or Secure Note is encrypted. Other fields like URL are in plain text, which may leak enough information to be sensitive, depending on what you consider sensitive. + However, on iOS, Keychain items are only accessible to the app that generated them, which is a huge plus. + It can sync across devices easily, because of iCloud integration, which is great for usability, but with weak encryption means if someone gains access to your iCloud, those passwords may be gone.

walterbell 7y ago
Are there technical reasons preventing Apple from addressing these weaknesses? Or is the native password manager deliberately weaker to enable 3rd-party apps?
- shakna 7y ago
  I'm not qualified to answer. I'm hoping someone else can chime in. I was somewhat surprised that it's still using 3DES. However, a perusal through what I believe is the latest source [0] shows me the latest updates (that I could find) where in 2010 - when 3DES was still widely used, and considered by most to be fairly secure. (Flaws were mostly revealed in 2014, and the complete exploits came in 2017). [0] https://opensource.apple.com/source/libsecurity_keychain/libsecurity_keychain-55050.9/lib/ https://opensource.apple.com/source/libsecurity_keychain/lib...