4 ms·
Keychain is a decent enough password manager, but there are some considerations you have to make if you're deciding whether you want it to be your default. + I
by shakna 7y ago
Keychain is a decent enough password manager, but there are some considerations you have to make if you're deciding whether you want it to be your default.
+ It uses Triple-DES encryption. This is probably not enough when it comes to a political campaign. It can be broken with commodity hardware. 3DES has a lot of collision attacks against it, and is deprecated in most software, and NIST consider it to only be effectively around 80-112bits.
+ It doesn't encrypt all your data fields. Only the password or Secure Note is encrypted. Other fields like URL are in plain text, which may leak enough information to be sensitive, depending on what you consider sensitive.
+ However, on iOS, Keychain items are only accessible to the app that generated them, which is a huge plus.
+ It can sync across devices easily, because of iCloud integration, which is great for usability, but with weak encryption means if someone gains access to your iCloud, those passwords may be gone.
- walterbell 7y agoAre there technical reasons preventing Apple from addressing these weaknesses? Or is the native password manager deliberately weaker to enable 3rd-party apps?
- shakna 7y agoI'm not qualified to answer. I'm hoping someone else can chime in. I was somewhat surprised that it's still using 3DES. However, a perusal through what I believe is the latest source [0] shows me the latest updates (that I could find) where in 2010 - when 3DES was still widely used, and considered by most to be fairly secure. (Flaws were mostly revealed in 2014, and the complete exploits came in 2017). [0] https://opensource.apple.com/source/libsecurity_keychain/libsecurity_keychain-55050.9/lib/ https://opensource.apple.com/source/libsecurity_keychain/lib...