3 ms·

It sort of has happened for Apple users. For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site yo

It sort of has happened for Apple users. For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site you use FaceID/TouchID to automatically pre-populate the password. At that point it really isn't a password in the traditional sense. And for an increasing number of sites it bypasses this step entirely and just lets me use FaceID/TouchID.

netizen-936824 5y ago
Why single out apple? This is the experience for anyone who uses a modern password manager
- daedalus_f 5y ago
  Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.
dotancohen 5y ago
> really isn't a password in the traditional sense. Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text? The user experience might have changed, but many of the security aspects have not.
- cmeacham98 5y ago
  I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure. On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.
  - dotancohen 5y ago
    Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too. https://webauthn.me/introduction https://webauthn.me/introduction
    - cmeacham98 5y ago
      True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.

netizen-936824 5y ago

Why single out apple? This is the experience for anyone who uses a modern password manager

daedalus_f 5y ago
Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.

dotancohen 5y ago

> really isn't a password in the traditional sense. Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text? The user experience might have changed, but many of the security aspects have not.

cmeacham98 5y ago
I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure. On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.
- dotancohen 5y ago
  Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too. https://webauthn.me/introduction https://webauthn.me/introduction
  - cmeacham98 5y ago
    True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.