5 ms·

This is a feature not a productTM. I switched to using safari’s password sync across mobile and desktop. It only works on iPhones and macOS desktop safari, but

This is a feature not a productTM. I switched to using safari’s password sync across mobile and desktop. It only works on iPhones and macOS desktop safari, but I adjusted my workflow. It’s both free, and reliable as long as Apple supports it. But I trust Apple to exist or migrate better than a dedicated product company like lastpass. Both for a decent user workflow and for not being breached (much scarier to me). I know that companies learn from security incidents and that we should reward, not punish companies for being transparent in their responses. But lastpass [0] has had issues with breaches and potential breaches and I’m nervous about storing bank passwords and whatnot with third parties. I used to recommend lastpass because it was easier to use and better than others. But now, for people who don’t know how computers work, I just recommend to buy an iPad or iPhone and use their password managers. I think it’s going to be tough, even if free, to compete with this. Doing stuff like making users choose between desktop and mobile, completely arbitrary with no real engineering driver, will just move more users away, I think. [0] https://en.wikipedia.org/wiki/LastPass https://en.wikipedia.org/wiki/LastPass

stingraycharles 6y ago
LastPass is one of the only ones that supports MFA on Linux and iPhone with my Yubikeys. Their security track record is a bit meh, but generally speaking, I’m very happy with how they integrate everywhere.
- michaelcampbell 6y ago
  I mean to each their own, but for a password manager security trumps integration for me.
  - ballenf 6y ago
    Are some of the options discussed more or less secure than the others?
    - michaelcampbell 6y ago
      Well, pedantically yes unless every option is exactly as secure as all the rest. Less pedantically there's stuff like: https://hackaday.com/2016/08/01/lastpass-happily-forfeits-passwords-to-simple-javascript/ https://hackaday.com/2016/08/01/lastpass-happily-forfeits-pa...
- StavrosK 6y ago
  BitWarden supports that too, I don't know about others.
harikb 6y ago
What you need to worry about being tightly integrated with Apple is not a hacker getting your data - it is being stuck with you or your surviving family not having access to your own data. This is my primary worry about walled gardens such as Apple or Google where you could be locked out of your own data because, you know, you looked at your phone the wrong way. In this instance, you are better of relying on someone whose primary business is to save passwords. They are more likely to have thought about this. For example, 1Password, explicitly offer an emergency kit[1] for your surviving family should something bad happen to you. They also used to have a zero-install reader called 1Password Anywhere, but that seems to have been discontinued. [1] https://support.1password.com/emergency-kit/ https://support.1password.com/emergency-kit/
- prepend 6y ago
  This is a good concern, and one I mitigate by keeping a file with trusted people that is to be used in case of my death. I think I’m better off relying on Apple’s business of protecting my identity (and selling me more apps, music, phones). And the effort spent on this by Apple is likely better than the primary purpose of a much smaller company. I also don’t think the incentives for a password as a service company that makes money off a monthly fee are lined up with mine. In time, I think they will only get worse as they layer on “features” to grow revenue from a fixed, and shrinking, market.
- Terretta 6y ago
  If you’re worried less about hackers and more about big brother, such as crossing borders, they also have a Travel mode that drops from your devices any password vaults not marked safe for Travel. Then toggle them back on after you don’t consider yourself or your data subject to inspection.
jwr 6y ago
> But I trust Apple to exist or migrate better than a dedicated product company I'm staring at my huge Aperture photo library (with tags, edits, versions and albums). Apple left me hanging. I would not assume anything of a huge company.
- Terretta 6y ago
  For all kinds of reasons, I hate what they did there, abandoning Aperture functionality — there remains zero other software that fills what Aperture did for me. Even though Capture One and Adobe Lightroom Classic can both import from it to a degree: https://learn.captureone.com/blog-posts/migrating-apple-aperture-libraries-to-capture-one-pro/ https://learn.captureone.com/blog-posts/migrating-apple-aper... That said, Aperture could still open an Aperture library using the final versions of Aperture up until Mojave. So from the time Aperture was discontinued, Aperture itself worked through six versions of MacOS, until Catalina. As of Catalina, Aperture no longer ran native[1], but Photos itself could still open and migrate those libraries (note: I have not tried in Big Sur). While Photos didn’t recognize everything initially, before Aperture became unsupported, Photos did eventually handle tags, non-destructive edits, JPEG+RAW pairs, referenced files, and albums. Apple eventually got the parity enough I was able to move a quarter million photos over into Photos, and haven’t needed to re-open Aperture in a couple years. While I haven’t needed it, I did test the software linked in [1] below, and it worked great. What to do if you’re on Catalina or newer, and need to migrate Aperture to Photos: https://support.apple.com/en-us/HT209594 https://support.apple.com/en-us/HT209594 --- 1. NOTE: Open Aperture on Big Sur or Catalina using ‘Retroactive’: https://github.com/cormiertyshawn895/Retroactive https://github.com/cormiertyshawn895/Retroactive From README: ”All Aperture features should be available except for playing videos, exporting slideshows, Photo Stream, and iCloud Photo Sharing. If RAW photos can't be opened, you need to reprocess them.” Read more: https://petapixel.com/2019/10/29/this-app-lets-you-use-apples-aperture-photo-editor-on-macos-catalina/ https://petapixel.com/2019/10/29/this-app-lets-you-use-apple...
crazygringo 6y ago
> This is a feature not a productTM. Hard disagree -- this is a product, not a feature. If it's a feature then it's tied to a single product. The whole reason I don't use Apple's or Chrome's built-in password syncing is because I need my passwords to also work on Android and on Firefox.
greggturkington 6y ago
- Terretta 6y ago
  They’re accessible outside of a browser, via a “keychain”, and the entire OS is built to use this keychain, which also syncs appropriately among your devices. On iOS, it’s Settings > Passwords. On MacOS, it’s Keychain Access, which looks like this: https://support.apple.com/guide/keychain-access/welcome/mac https://support.apple.com/guide/keychain-access/welcome/mac There is also a UI in Safari itself, which on MacOS has added some advisory features, including easily guessed, seen in a data leak, or used on multiple sites: https://support.apple.com/en-sg/guide/safari/sfri40599/mac https://support.apple.com/en-sg/guide/safari/sfri40599/mac On MacOS, you can also use the keychain with ssh on the command line: https://rderik.com/blog/understanding-ssh-keys-and-using-keychain-to-manage-passphrase-on-macos/ https://rderik.com/blog/understanding-ssh-keys-and-using-key...
benhurmarcel 6y ago
It only handles login and passwords though. No other fields.

stingraycharles 6y ago

LastPass is one of the only ones that supports MFA on Linux and iPhone with my Yubikeys. Their security track record is a bit meh, but generally speaking, I’m very happy with how they integrate everywhere.

michaelcampbell 6y ago
I mean to each their own, but for a password manager security trumps integration for me.
- ballenf 6y ago
  Are some of the options discussed more or less secure than the others?
  - michaelcampbell 6y ago
    Well, pedantically yes unless every option is exactly as secure as all the rest. Less pedantically there's stuff like: https://hackaday.com/2016/08/01/lastpass-happily-forfeits-passwords-to-simple-javascript/ https://hackaday.com/2016/08/01/lastpass-happily-forfeits-pa...
StavrosK 6y ago
BitWarden supports that too, I don't know about others.

harikb 6y ago

What you need to worry about being tightly integrated with Apple is not a hacker getting your data - it is being stuck with you or your surviving family not having access to your own data. This is my primary worry about walled gardens such as Apple or Google where you could be locked out of your own data because, you know, you looked at your phone the wrong way. In this instance, you are better of relying on someone whose primary business is to save passwords. They are more likely to have thought about this. For example, 1Password, explicitly offer an emergency kit[1] for your surviving family should something bad happen to you. They also used to have a zero-install reader called 1Password Anywhere, but that seems to have been discontinued. [1] https://support.1password.com/emergency-kit/ https://support.1password.com/emergency-kit/

prepend 6y ago
This is a good concern, and one I mitigate by keeping a file with trusted people that is to be used in case of my death. I think I’m better off relying on Apple’s business of protecting my identity (and selling me more apps, music, phones). And the effort spent on this by Apple is likely better than the primary purpose of a much smaller company. I also don’t think the incentives for a password as a service company that makes money off a monthly fee are lined up with mine. In time, I think they will only get worse as they layer on “features” to grow revenue from a fixed, and shrinking, market.
Terretta 6y ago
If you’re worried less about hackers and more about big brother, such as crossing borders, they also have a Travel mode that drops from your devices any password vaults not marked safe for Travel. Then toggle them back on after you don’t consider yourself or your data subject to inspection.

jwr 6y ago

> But I trust Apple to exist or migrate better than a dedicated product company I'm staring at my huge Aperture photo library (with tags, edits, versions and albums). Apple left me hanging. I would not assume anything of a huge company.

Terretta 6y ago
For all kinds of reasons, I hate what they did there, abandoning Aperture functionality — there remains zero other software that fills what Aperture did for me. Even though Capture One and Adobe Lightroom Classic can both import from it to a degree: https://learn.captureone.com/blog-posts/migrating-apple-aperture-libraries-to-capture-one-pro/ https://learn.captureone.com/blog-posts/migrating-apple-aper... That said, Aperture could still open an Aperture library using the final versions of Aperture up until Mojave. So from the time Aperture was discontinued, Aperture itself worked through six versions of MacOS, until Catalina. As of Catalina, Aperture no longer ran native[1], but Photos itself could still open and migrate those libraries (note: I have not tried in Big Sur). While Photos didn’t recognize everything initially, before Aperture became unsupported, Photos did eventually handle tags, non-destructive edits, JPEG+RAW pairs, referenced files, and albums. Apple eventually got the parity enough I was able to move a quarter million photos over into Photos, and haven’t needed to re-open Aperture in a couple years. While I haven’t needed it, I did test the software linked in [1] below, and it worked great. What to do if you’re on Catalina or newer, and need to migrate Aperture to Photos: https://support.apple.com/en-us/HT209594 https://support.apple.com/en-us/HT209594 --- 1. NOTE: Open Aperture on Big Sur or Catalina using ‘Retroactive’: https://github.com/cormiertyshawn895/Retroactive https://github.com/cormiertyshawn895/Retroactive From README: ”All Aperture features should be available except for playing videos, exporting slideshows, Photo Stream, and iCloud Photo Sharing. If RAW photos can't be opened, you need to reprocess them.” Read more: https://petapixel.com/2019/10/29/this-app-lets-you-use-apples-aperture-photo-editor-on-macos-catalina/ https://petapixel.com/2019/10/29/this-app-lets-you-use-apple...

crazygringo 6y ago

> This is a feature not a productTM. Hard disagree -- this is a product, not a feature. If it's a feature then it's tied to a single product. The whole reason I don't use Apple's or Chrome's built-in password syncing is because I need my passwords to also work on Android and on Firefox.

greggturkington 6y ago

Terretta 6y ago
They’re accessible outside of a browser, via a “keychain”, and the entire OS is built to use this keychain, which also syncs appropriately among your devices. On iOS, it’s Settings > Passwords. On MacOS, it’s Keychain Access, which looks like this: https://support.apple.com/guide/keychain-access/welcome/mac https://support.apple.com/guide/keychain-access/welcome/mac There is also a UI in Safari itself, which on MacOS has added some advisory features, including easily guessed, seen in a data leak, or used on multiple sites: https://support.apple.com/en-sg/guide/safari/sfri40599/mac https://support.apple.com/en-sg/guide/safari/sfri40599/mac On MacOS, you can also use the keychain with ssh on the command line: https://rderik.com/blog/understanding-ssh-keys-and-using-keychain-to-manage-passphrase-on-macos/ https://rderik.com/blog/understanding-ssh-keys-and-using-key...

benhurmarcel 6y ago

It only handles login and passwords though. No other fields.