8 ms·

Apple releases open source 'Password Manager Resources' project for developers

87 points by sharjeelsayed 6y ago

dewey 6y ago
Direct link to Github: https://github.com/apple/password-manager-resources https://github.com/apple/password-manager-resources Seems like a good idea, instead of every password manager trying to re-implement the same kind of edge cases. One day I hope we can just "muss change" password because sites follow a common theme like https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html - but maybe we have a better strategy than passwords until then.
- deleted 6y ago
  [deleted]
- tialaramex 6y ago
  If Apple wants to throw their weight around on this, that would be best directed at pushing sites to stop having stupid rules IMNSHO. Of the documented rules only minimum password length is even an excusable rule. Should your site accept 40kB passwords? No, but that's not a "maximum password length" rule at that point it's just common sense about unauthenticated payload sizes. Whereas this list includes limits of just eight characters and in one case simply 4 digits. The other restrictions - required or prohibited characters - and the shared credential quirk (systems that let you, indeed often require you to use the same credentials but on different FQDNs) are both making users less safe. While there's an argument that just documenting them is neutral I'd argue that for an outfit with Apple's clout it isn't enough and they need to be loudly calling for reform. That's tempered by the knowledge that Apple has never been very good at doing more than one thing. "Password stores" are definitely not the new iPhone, and so they can't pivot their whole company to this problem, and maybe in the absence of that level of focus this is all they can offer, but that's kind of a shame on its own.
  - LaGrange 6y ago
    > Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit. Everything beyond a certain point (56 bytes) is just ignored. It's possible to work around, but that's messy and you're no longer do "the" bcrypt, bye bye interoperability. And if you don't enforce it, someone might do something silly-but-apparently-harmless, like reuse a long passphrase with some randomness at the end. Edge case, but not impossible. Of course in 2020 you probably should be using things like Argon or something (actually haven't researched the current best in a couple of years, so no longer sure)., but AFAIR Rails, for example, still comes with just bcrypt by default.
  - Someone1234 6y ago
    This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of interop with Oracle systems behind the scenes (we authenticated users twice, once in the web app which could have unlimited passwords stored as PBKDF2, and then again with an Oracle system that was hard restricted). A lot of businesses have backwards compatibility or proprietary systems in the way. [0] https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...
  - eli 6y ago
    Unfortunately I think they'd rather you just authorize everything against your Apple ID.
    - tialaramex 6y ago
      That's far from the worst outcome. There are anti-trust concerns in play of course, and we certainly don't want a world where anybody without an AppleID is a second class citizen, but from the security side such systems are a win-win for users and site owners.
- vulcan01 6y ago
  I feel like the GitHub link should be the submission link, not 9to5Mac which doesn't really give extra useful info...
dfee 6y ago
I’ll say it. This is kind of a joke. Not that it would be a joke if an individual developer released it, and built an active community who contributed, or if it was more than 100 websites long. But the heavy publicity push seems a bit early. And, it feels like Apple’s announcement is little more than “hey guys, check out this POC repo!”. It kinda feels like Apple doesn’t get OSS.
- dewey 6y ago
  https://developer.apple.com/news/?id=06052020a&1591373342 https://developer.apple.com/news/?id=06052020a&1591373342 doesn't seem like a "heavy publicity push". It's a niche topic and the target audience of people who build password managers isn't exactly a huge one.
  - dfee 6y ago
    1 hour ago this began appearing on plenty of Mac news sites. The PR game is a push not a pull.
    - dewey 6y ago
      Every tiny bit of information trickling out of Apple is circulating on Mac news site. Even if it's just a delivery date changing somewhere in the store. These news site are actively looking for that. I doubt the PR department is pushing out a footnote on the developer portal to a bunch of Mac rumor blogs.
      - threeseed 6y ago
        It's not even on the major Mac rumor blogs. MacRumors and AppleInsiders both don't have the article.
        Hamuko 6y ago
        https://www.macrumors.com/2020/06/05/apple-open-source-password-management-project/ https://www.macrumors.com/2020/06/05/apple-open-source-passw... https://appleinsider.com/articles/20/06/05/apple-announces-open-source-project-for-password-manager-developers https://appleinsider.com/articles/20/06/05/apple-announces-o...
mikece 6y ago
The idea of reading a password manager reading a website's password rules (which they are calling "quirks" apparently) is a great idea as the app would then know what the controlling parameters are (15 characters, must have an upper, a lower, and three special characters) when it auto-generates a password. Since I started using KeePassXC I've been shocked at how many websites -- especially financial institutions! -- don't allow you to use 64 character long passwords using multiple "special characters" (why would you make a password rule that says I can only use five select non-number, non-letter characters and only "one to three" of said characters?)...
- LeoPanthera 6y ago
  I cannot conceive of any situation that would make a 64 character password necessary. Even 256 bits of random data can be encoded into less than 42 printable ASCII characters. And even that is twice as much as would ever seem necessary.
  - dgellow 6y ago
    Do you see a reason to forbid it?
  - tonyedgecombe 6y ago
    If the customer wants to do it why should the institution care?
  - mikece 6y ago
    Why 64 characters? Because 128 would be too much... Seriously though, I like obnoxiously long passwords because it clues me in to who is storing my password in a manner than can be reverted to plain text if not in plaintext directly. If you're using a salted hash to store my password it shouldn't make a difference whether my password is "HN/2020/Jun!" or the full text of War and Peace -- just the hash will be stored. Anyone who tells me my password is too long makes me nervous because they are doing something different. And of course I'm a little paranoid: how many breach datasets are your credentials in?
  - tzs 6y ago
CornishPasty 6y ago
I feel like this would be better as a Well-Known URI, for example /.well-known/password-manager.json with similar format to the repo – That way it's not up to Apple to decide what goes in the repository
- deleted 6y ago
  [deleted]
- Someone1234 6y ago
  Sites would immediately use it to essentially disable password managers "for security." Sites have done everything they can to block password managers historically, I don't anticipate that changing.
  - merightnow 6y ago
    Why would any site do that? Other than in a banks website I haven't encountered that behaviour previously
    - Someone1234 6y ago
      You're asking the wrong person: Sites shouldn't do that. But they do, often. Banks are the worst offenders, but it isn't limited to that. Any site that thinks it is "special" and requires "extra security" targets password managers for reasons unknown.
Hamuko 6y ago
I just wish Apple allowed better integration with third-party password managers.
- toomuchtodo 6y ago
  They are upgrading Keychain to be a first class password manager in iOS14. Along with WebAuthN improvements, this might negate the need for many third party password managers.
  - Hamuko 6y ago
    How do I use Keychain with Firefox?
    - Twisell 6y ago
      At some point you however have to wonder : Is it up to a browser to support the OS native password manager, or is it the burden of the OS maker to provide a plugin for each browser? Beside Firefox now provide it's own password manager. But it is awkwardly limited within the browser. Same with the recently touted picture in picture mode of Firefox. While I understand it might be enjoyable on OS that don't support that natively it's particularly laughable on OS that does it. Now You potentially have 3 layers of picture in picture implementation. The website, the browser and the OS... (And as you might guess the OS offer the best experience because it have control over all graphical layers).
    - toomuchtodo 6y ago
      Can’t yet. Valid use case, point taken. I use Safari.
      - xenospn 6y ago
        I keep meaning to try different browsers and then realizing I'd have to manually migrate all of my passwords from safari. Not going to happen.

87 points by sharjeelsayed 6y ago

Direct link to Github: https://github.com/apple/password-manager-resources https://github.com/apple/password-manager-resources Seems like a good idea, instead of every password manager trying to re-implement the same kind of edge cases. One day I hope we can just "muss change" password because sites follow a common theme like https://wicg.github.io/change-password-url/index.html https://wicg.github.io/change-password-url/index.html - but maybe we have a better strategy than passwords until then.

deleted 6y ago
[deleted]
tialaramex 6y ago
If Apple wants to throw their weight around on this, that would be best directed at pushing sites to stop having stupid rules IMNSHO. Of the documented rules only minimum password length is even an excusable rule. Should your site accept 40kB passwords? No, but that's not a "maximum password length" rule at that point it's just common sense about unauthenticated payload sizes. Whereas this list includes limits of just eight characters and in one case simply 4 digits. The other restrictions - required or prohibited characters - and the shared credential quirk (systems that let you, indeed often require you to use the same credentials but on different FQDNs) are both making users less safe. While there's an argument that just documenting them is neutral I'd argue that for an outfit with Apple's clout it isn't enough and they need to be loudly calling for reform. That's tempered by the knowledge that Apple has never been very good at doing more than one thing. "Password stores" are definitely not the new iPhone, and so they can't pivot their whole company to this problem, and maybe in the absence of that level of focus this is all they can offer, but that's kind of a shame on its own.
- LaGrange 6y ago
  > Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit. Everything beyond a certain point (56 bytes) is just ignored. It's possible to work around, but that's messy and you're no longer do "the" bcrypt, bye bye interoperability. And if you don't enforce it, someone might do something silly-but-apparently-harmless, like reuse a long passphrase with some randomness at the end. Edge case, but not impossible. Of course in 2020 you probably should be using things like Argon or something (actually haven't researched the current best in a couple of years, so no longer sure)., but AFAIR Rails, for example, still comes with just bcrypt by default.
- Someone1234 6y ago
  This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of interop with Oracle systems behind the scenes (we authenticated users twice, once in the web app which could have unlimited passwords stored as PBKDF2, and then again with an Oracle system that was hard restricted). A lot of businesses have backwards compatibility or proprietary systems in the way. [0] https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...
- eli 6y ago
  Unfortunately I think they'd rather you just authorize everything against your Apple ID.
  - tialaramex 6y ago
    That's far from the worst outcome. There are anti-trust concerns in play of course, and we certainly don't want a world where anybody without an AppleID is a second class citizen, but from the security side such systems are a win-win for users and site owners.
vulcan01 6y ago
I feel like the GitHub link should be the submission link, not 9to5Mac which doesn't really give extra useful info...

dfee 6y ago

I’ll say it. This is kind of a joke. Not that it would be a joke if an individual developer released it, and built an active community who contributed, or if it was more than 100 websites long. But the heavy publicity push seems a bit early. And, it feels like Apple’s announcement is little more than “hey guys, check out this POC repo!”. It kinda feels like Apple doesn’t get OSS.

dewey 6y ago
https://developer.apple.com/news/?id=06052020a&1591373342 https://developer.apple.com/news/?id=06052020a&1591373342 doesn't seem like a "heavy publicity push". It's a niche topic and the target audience of people who build password managers isn't exactly a huge one.
- dfee 6y ago
  1 hour ago this began appearing on plenty of Mac news sites. The PR game is a push not a pull.
  - dewey 6y ago
    Every tiny bit of information trickling out of Apple is circulating on Mac news site. Even if it's just a delivery date changing somewhere in the store. These news site are actively looking for that. I doubt the PR department is pushing out a footnote on the developer portal to a bunch of Mac rumor blogs.
    - threeseed 6y ago
      It's not even on the major Mac rumor blogs. MacRumors and AppleInsiders both don't have the article.
      - Hamuko 6y ago
        https://www.macrumors.com/2020/06/05/apple-open-source-password-management-project/ https://www.macrumors.com/2020/06/05/apple-open-source-passw... https://appleinsider.com/articles/20/06/05/apple-announces-open-source-project-for-password-manager-developers https://appleinsider.com/articles/20/06/05/apple-announces-o...

mikece 6y ago

The idea of reading a password manager reading a website's password rules (which they are calling "quirks" apparently) is a great idea as the app would then know what the controlling parameters are (15 characters, must have an upper, a lower, and three special characters) when it auto-generates a password. Since I started using KeePassXC I've been shocked at how many websites -- especially financial institutions! -- don't allow you to use 64 character long passwords using multiple "special characters" (why would you make a password rule that says I can only use five select non-number, non-letter characters and only "one to three" of said characters?)...

LeoPanthera 6y ago
I cannot conceive of any situation that would make a 64 character password necessary. Even 256 bits of random data can be encoded into less than 42 printable ASCII characters. And even that is twice as much as would ever seem necessary.
- dgellow 6y ago
  Do you see a reason to forbid it?
- tonyedgecombe 6y ago
  If the customer wants to do it why should the institution care?
- mikece 6y ago
  Why 64 characters? Because 128 would be too much... Seriously though, I like obnoxiously long passwords because it clues me in to who is storing my password in a manner than can be reverted to plain text if not in plaintext directly. If you're using a salted hash to store my password it shouldn't make a difference whether my password is "HN/2020/Jun!" or the full text of War and Peace -- just the hash will be stored. Anyone who tells me my password is too long makes me nervous because they are doing something different. And of course I'm a little paranoid: how many breach datasets are your credentials in?
- tzs 6y ago

CornishPasty 6y ago

I feel like this would be better as a Well-Known URI, for example /.well-known/password-manager.json with similar format to the repo – That way it's not up to Apple to decide what goes in the repository

deleted 6y ago
[deleted]
Someone1234 6y ago
Sites would immediately use it to essentially disable password managers "for security." Sites have done everything they can to block password managers historically, I don't anticipate that changing.
- merightnow 6y ago
  Why would any site do that? Other than in a banks website I haven't encountered that behaviour previously
  - Someone1234 6y ago
    You're asking the wrong person: Sites shouldn't do that. But they do, often. Banks are the worst offenders, but it isn't limited to that. Any site that thinks it is "special" and requires "extra security" targets password managers for reasons unknown.

Hamuko 6y ago

I just wish Apple allowed better integration with third-party password managers.

toomuchtodo 6y ago
They are upgrading Keychain to be a first class password manager in iOS14. Along with WebAuthN improvements, this might negate the need for many third party password managers.
- Hamuko 6y ago
  How do I use Keychain with Firefox?
  - Twisell 6y ago
    At some point you however have to wonder : Is it up to a browser to support the OS native password manager, or is it the burden of the OS maker to provide a plugin for each browser? Beside Firefox now provide it's own password manager. But it is awkwardly limited within the browser. Same with the recently touted picture in picture mode of Firefox. While I understand it might be enjoyable on OS that don't support that natively it's particularly laughable on OS that does it. Now You potentially have 3 layers of picture in picture implementation. The website, the browser and the OS... (And as you might guess the OS offer the best experience because it have control over all graphical layers).
  - toomuchtodo 6y ago
    Can’t yet. Valid use case, point taken. I use Safari.
    - xenospn 6y ago
      I keep meaning to try different browsers and then realizing I'd have to manually migrate all of my passwords from safari. Not going to happen.