3 ms·

If you use a password manager to save your password and don't lose access to the password manager, you are safe. All you need is your password to sign in. I w

If you use a password manager to save your password and don't lose access to the password manager, you are safe. All you need is your password to sign in. I was only describing the hypothetical approach we're planning to implement for someone who forgets their password. And yes, if I'm understanding right, I think those threat risks are very different. One is trusting your device which you yourself have control over, the other is trusting a cloud-based service provided by Apple, which you do not have control over. Not everyone uses Apple products either :) Edit: But alas, it's a user's choice how they want to save their password. If Apple provides a static key over this service and users really want this option, it's definitely worth exploring further :)

ec109685 7y ago
Good point. I think what ultimately should be done is browsers should provide access to secure tokens that are stored in the user’s keychain (or Google equivalent). The Keychain is end to end encrypted and they have done the hard work in propagating data securely across devices. Then there are no passwords and user is in control over which devices have access to their data. Access to device equals access to data, which I think most people would be comfortable with (e.g. you don’t sign into your email account on your phone each day).
- j-berman 7y ago
  Yes! This would be awesome