22 ms·

Apple passwords deserve an app

1260 points by ttepasse 4y ago

teeeg 4y ago
i would prefer icloud keychain allows an alternative password - i refrain from adding some credentials to the keychain since my passcode is easy to steal?
- isleyaardvark 4y ago
  Reading other comments in this thread and I feel like I am taking crazy pills. There was a big article that I thought a lot of people had read and would realize having passwords saved under an iCloud account is a recipe for disaster, since only a phone passcode is necessary to gain full control of an iCloud account. https://news.ycombinator.com/item?id=34984821 https://news.ycombinator.com/item?id=34984821
ajani 4y ago
> Passwords are productivity, not preferences. Surely passwords are security?
cramjabsyn 4y ago
I agree it could be more polished but there is an app called Keychain Access that does give reasonable access/search/management of icloud passwords
robinhood 4y ago
I'm okay to move my photos to Apple. I'm okay to move my music. But I'm not ready to move my passwords and tie them to the Apple ecosystem. 1password for the win.
TheRealDunkirk 4y ago
Regardless of how great they might make an interface for it, passwords are the last thing I haven't given to Apple. If I lost control of my Apple ID, it would be a disaster, but at least it wouldn't expose everything else as well. I have a hard time getting over this mental hurdle, so it's 1Password for the foreseeable future for me, no matter what they do here.
adultSwim 4y ago
Passwords stink. I want to think about them less, not more.
Despegar 4y ago
I guess everyone is over the anti-"self-preferencing" policy push over the past few years and is back to normal. Sherlocking is in fact good.
cjdoc29 4y ago
I really like Apple's implementation of passwords, passkeys, etc. But...I had a hard time explaining this to my mom. She uses it to generate her passwords and fill-in within Safari which is great! But there's no "Passwords" app, and she didn't know to go into Settings to reference a password when Safari doesn't recognize a password field (probably the website's fault). 2FA is also a confusing experience, but 2FA is also just confusing enough for her where Apple isn't really the problem here.
- reaperducer 4y ago
  But there's no "Passwords" app It's called Keychain Access.
  - cj 4y ago
    The problem is Keychain Access doesn't pass the "mom test" (would you average consumer - e.g. your mom - actually use it)
    - airstrike 4y ago
      They don't even know why it's called that
      - shagie 4y ago
        Because you can store non-passwords in there too. Secure notes, your own signing certificates, keys, root CAs, and specific self signed certs you've accepted for SSL.
        airstrike 4y ago
        Still, none of that means anything to the average user. Searching for "passwords" in Spotlight should also take you to your passwords
        shagie 4y ago
isoprophlex 4y ago
What the actual flying fuck, the apple password thing supports TOTP! That's great! (And a sad testament to how poorly the discoverability is on some ios features)
- brycedriesenga 4y ago
  Isn't it considered not great to do TOTP and password storage in the same place?
- dwaite 4y ago
  Not just that, they will detect QR code images to work around sites which assume that TOTP is only available by scanning your desktop screen from your phone.
  - matt-attack 4y ago
    Can you provide an example website that uses this technology? Not sure I've ever encountered one.
    - deleted 4y ago
      [deleted]
    - Gigachad 4y ago
      Uh, basically all of them? They all show a QR code and never show you the secret which you could copy in to your password manager.
  - kitsunesoba 4y ago
    Step Two[1] also does this, which is one of the reasons I've been using it for TOTP for the past few years. Nice to see that the built-in TOTP support can do that now too. [1]: https://steptwo.app https://steptwo.app
hnrodey 4y ago
I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven forbid you need search it's only a simple 37 clicks away! I think those were my big complaints. If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired.
- grammers 4y ago
  Sounds like vendor lockin is the aim here, not being fully cross-platform without any hassle.
- chakintosh 4y ago
  > 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. Ditto. Why do I have to replace my Windows login password with a "PIN" code that's the same as the iCloud Keychain PIN !? That's super weird!
- AdmiralAsshat 4y ago
  > If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working as designed."
  - lozenge 4y ago
    With passkeys, now every platform can enjoy this level of lock in!
    - rootusrootus 4y ago
      I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.
OCISLY 4y ago
I still miss Mozilla Lockwise.
- benatkin 4y ago
  At least Firefox makes it easy to view your Firefox passwords. In Chrome it's nested in settings and the text box where it shows the password is tiny.
mattkevan 4y ago
I've always used Keychain Access to view/manage passwords. If they cleaned up the UI a bit it'd do pretty much exactly what Cabel is talking about here.
teabee89 4y ago
I will tell my family to use iCloud Keychain the day when it works across all major browsers and OSes. Or at least that they provide an API to sync with other password managers.
galad87 4y ago
They already have an app, Keychain Access, but for weird reasons they integrated the new features into System Setting instead of expanding the existing app.
waboremo 4y ago
Fully in agreement here, getting people used to Apple Passwords can be a task purely because it's stuffed into settings. Would like to see them in the process of transitioning it away from settings, also include the ability to change the name of the entries. Multiple URLs per login would be great too (or even a linking of separate entries). Think these are the biggest things keeping many general users still relying on the likes of 1Password/Bitwarden, which is where I disagree with the writer here, I think third party password tools should be replaced by sane defaults as soon as possible outside of niche cases.
dwheeler 4y ago
> And it all syncs across your devices, for free?! Really? My Linux devices? Android? Windows? I don't think so. I recommend considering one of the most important features of a password manager is that it doesn't force you to use a single manufacturer's products forever. Even if you swear undying fealty to Apple (or anyone else) today, you might change your mind in the future. 1Password, Bitwarden, and others allow me to switch PC manufacturer, phone manufacturer, browser, and so on. I can't tell you how many people used to think "Internet Explorer is popular, it'll always be the one and only browser". That did not end well.
- geocar 4y ago
  > Even if you swear undying fealty to Apple (or anyone else) today, you might change your mind in the future. Changing my mind is easy enough: I can export my iCloud passwords to a csv file, and I've done this to transfer a bunch of passwords to Firefox Linux desktop. I'll tell you something though: If Bitwarden leaked passwords nothing would happen because America has very weak consumer protections, but if Google or Apple leaked passwords, they'd be hit in every EU member state for GDPR. Some of these things are outside of my control, and using a password manager is too useful that I think it's worth a little risk, but I can't justify trusting any company unless they've got some skin in the game, and Bitwarden specifically wants to disclaim all liabilities? AgileBits thankfully is in Canada and you can at least sue them for what you've paid them in six months, but I personally have passwords more important than that. Surely there's someone else you could recommend?
  - error503 4y ago
    Self-host vaultwarden at the cloud provider of your choice?
    - tasuki 4y ago
      What is the point of this? Isn't it easier/simpler/better to just sync a file with the passwords rather than keep a server running?
elsurudo 4y ago
I use Keychain Access app, but admittedly the UX there is terrible. I wish it was nicer, and also integrated with browsers other than Safari.
Schiendelman 4y ago
I think the reason Apple hasn't prioritized this is that with their login with Apple implementations and passkeys, the utility of copying/pasting or looking up a password is dropping over time.
aeharding 4y ago
You can make an iOS shortcut to make it appear as an "app" (launches keychain manager). I did this for some elderly folk, works great.
CryptoBanker 4y ago
Oh god please no
tikkun 4y ago
While we're on the subject, other Apple things that deserve an app: Dashboard/status - I have a smart lock, and they have their own app, where all it really does is show the current status of the lock and let me toggle it. There are quite a few apps like this. It'd be nice if they could all be condensed into a dashboard/status app that could just tweak values and show current status. Apple Home attempts to do some of this. Notifications - It'd be nice if there was a notifications app, and I could set most of my apps to deliver their notifications to that app, instead of me directly. This would reduce notification overload and distraction.
- Spivak 4y ago
  Isn't that first one Home/iHome/HomeKit whatever you wanna call it? If your lock doesn't support HomeKit there's a good chance Homebridge does.
- WorldMaker 4y ago
  Have you tried Notification Summaries yet? That's sort of like a "deliver notifications to a separate app". In the notifications settings you create at least one Scheduled Notification Summary. I've currently got ones setup roughly every four hours during "core daylight hours" for me, plus I enable the "preview option" to read the next summary early if I need to. Then you add as many apps as you want to the Notification Summaries. All of the notifications for those apps during each time period get rolled up into a single Summary object in your notifications, only give a notification alert once for the entire group of them (at the scheduled time), and don't cause Watch notifications (if that's a distraction/overload you especially juggle as I do). At this point I've even got all my email notifications going into Summaries (which is why I turned on the preview for the next summary if I feel like I need a quick glance at recent email subject lines without opening my email app up). It is such a useful tool and not a lot of iOS users discover it in the settings. May also be an indicator that it could use its own app because discovery in the Settings app itself is hard. Maybe the Settings app is just doing too many things now and needs some sort of reorg or something.
aaronharnly 4y ago
I follow Ricky Mondello, who works on the Apple password keeper functionality — they post interesting tidbits pretty regularly. https://twitter.com/rmondello https://twitter.com/rmondello https://hachyderm.io/@rmondello https://hachyderm.io/@rmondello
- selykg 4y ago
  I met Ricky at a WWDC years ago when I was in the password manager field. What a wonderfully intelligent person. Actually, several members of the Safari team were present at that meeting and it was such a great set of people. I kind of miss that part of that job...
- filmgirlcw 4y ago
  +1 Ricky is the best. They also made a very useful Shortcut [1] that offers quick access to the Passwords on your Home Screen or Mac menubar. [1]: https://rmondello.com/passwords-shortcut/ https://rmondello.com/passwords-shortcut/
  - shikshake 4y ago
    clicking this link throws a bunch of warnings in my browser, and my university internet blocks me from seeing the actual website :(
    - testfrequency 4y ago
      https://www.icloud.com/shortcuts/cd5b0ec116ee4d1d86548238394c1679 https://www.icloud.com/shortcuts/cd5b0ec116ee4d1d86548238394...
      - filmgirlcw 4y ago
        Thanks for that! My work machine blocks this too ironically, which is weird since Ricky is my friend and I know they are trustworthy. I’ll let them know.
    - deleted 4y ago
WorldMaker 4y ago
It took effort but I finally got my dad to use 1Password regularly, but my mom would be a lot easier to convince if Apple just made its own password tools easier to use, especially cross-platform, including maybe putting a nice app face on it. > PPS: I dream of a future where Passkeys could make the password manager extinct. But it’ll take time… Passkeys even more so need more of a "curated app experience" to work right, cross platform. Ironically, it is my impression that preparing for Passkeys is why Apple finally added that password explorer to Windows' weird iCloud "control panel". (For a long time, the only way to use iCloud passwords on Windows was the awful Edge/Chrome integration.)
kylehotchkiss 4y ago
internally, apple used to have a pretty big 1Password contract - https://appleinsider.com/articles/18/07/10/apple-looking-to-deploy-1password-company-wide-may-buy-out-apps-developer https://appleinsider.com/articles/18/07/10/apple-looking-to-... Maybe they don’t want to promote their own too heavily, to allow 1Password to take on the organizational risk of running a password manager? (For context, think about your current view of lastpass vs how you felt about it a year before their leak). Maybe the internal password management functionality is better suited to orgs which restrict third party apps?
- arghnoname 4y ago
  1password has features that are useful in a large corporation that keychain does not have, particularly around sharing passwords and password vaults. I haven't noticed even minimal credential sharing facilities in keychain.
  - dwaite 4y ago
    WRT credential sharing, you can airdrop credentials to people on your contacts list. But multiple vaults and vault sharing - no such luck. I don't think they want to deal with the UX confusion of it, especially since that confusion could lead to someone getting locked out of things.
great_psy 4y ago
I have been using the Apple manager since LastPass got hacked recently. Hot take , but … I like the lack of integration in other operating systems/ browsers. I see my phone as a Secure Enclave, and my passwords should be disconnected from potentially insecure systems. I see the phone as those keychain one time passwords where you have to press a physical button to get a key. Is it inconvenient to get a password, yes. But it offers the piece of mind that I only have to worry about iPhone/Apple exploits, instead of chrome+firefox+windows+Linux+Apple+iphone. I don’t think in this case Apple is not doing the integration because of this security feature, but I think it is a feature non the less. Of course you can always choose not to install the extensions even if they existed, but the point is that if they existed it would lower security.
- imwithstoopid 4y ago
  don't lose or break your phone....
  - MBCook 4y ago
    iCloud solves that.
    - whitewingjek 4y ago
      Unless Apple ever starts following Google's lead to ban accounts for any infraction and you don't store backups... Not saying Apple is doing that now, but I imagine it's not outside the realm of possibility.
      - great_psy 4y ago
        We can use the same argument for any other cloud password manager. If google/Apple blocks my access, well it’s those services I am trying to log into in the first place so the point is moot. Also I have recovery keys for the more important accounts printed and stored in a safe box.
        4y ago
kernal 4y ago
Setting up TOTP on an iPhone. I had no idea it could do this. https://support.apple.com/en-ca/guide/iphone/ipha6173c19f/ios https://support.apple.com/en-ca/guide/iphone/ipha6173c19f/io...
abraxas 4y ago
If Apple password manager is anywhere as well thought out as their 2FA for Apple TV then I don't want to come next to it within 10 light years. Every time it asked me to either "confirm on your iPad" (I have 3 of those around the house) or "confirm on your iPhone" (I have 0 of those) I was ready to hurl shit. SMS option buried in some dark pattern, of course. If these companies want to encroach in the secrets management space they really need to hire more qa and test more than a single happy path. The number of failure modes in these systems is astonishing for the billions of dollars these companies can throw at the problem.
- Tepix 4y ago
  I suggest you move to Ross 248, which is a mere 10.3 light-years away. However, 32000 years from now it will be the closest star to our sun at 3.024 light-years so keep that in mind!
- twobitshifter 4y ago
  I think there’s a setting for that in setup. Is your problem that Apple thinks you have a iPhone or that you have to interact with the tv on a second device? As with all things apple when you buy in you get the best experience. That feature on AppleTV works really well with an Apple Watch.
  - capableweb 4y ago
    Which really sucks and puts you off from getting more Apple devices if you're a person who slowly buys into the ecosystem rather than go all-in without testing things. Personally, I was a fan of Apple laptops between something like 2010 - 2015, but after that I just couldn't deal with it anymore, as I had a Android phone and nothing else Apple. Fast forward to 2019, Apple finally releases a phone that fits in my tiny hands, so I get a iPhone 12 Mini, thinking that the CarPlay experience will be loads better than Android Auto on a measly Moto G. But holy smokes if I wasn't wrong, CarPlay is a UX disaster and I can't wait for the iPhone to break somehow or get too slow because of OS upgrades, so I can justify buying a new phone again. Just the simple fact that a phone calls covers the entire screen (which I use for GPS) seems like such a simple use case that they somehow missed, that I just wanna bin the entire system and I'll never buy Apple hardware for daily use again. I still have to use Apple laptops for software I release, but every time, I'm reminded how great the UX used to be, but how far they have fallen. Really sad to see. Windows is no better either, each version gets worse and worse...
sylens 4y ago
Even if macOS and iOS are my primary work (and personal) platforms these days, I still like a solution that works great on Windows, Linux, and Android as well. I'm pretty happy with 1Password - it does all of the things mentioned in this article with more platform support
- ehsankia 4y ago
  Exactly, this is why many of the Apple services are useless unless you are 110% in their ecosystem. At least Apple Music is the one app they somehow made available on Android and Windows.
  - mmmmmbop 4y ago
    There's a feature on the AirPods that allows you to enroll them in your iCloud account enabling Find My. All you need to do is connect the AirPods to an iCloud-enrolled Apple device, and it will automatically connect to that iCloud account. Oh, but it's not any iCloud-enrolled device, it must be an iOS device. Connecting them to my MacBook didn't do anything. I went into the Apple Store to ask for a solution to that problem. They legitimately asked me why I'm buying AirPods if I don't have an iPhone -- they're called Air Pods after all... Anyway, their proposed solution was for me to buy a refurbished iPad for $450 to connect the AirPods to my iCloud.
  - cglong 4y ago
    Apple Music started its life as Beats IIRC, so a good cross-plat UX was part of the acquisition. See also Shazam.
- lfciv 4y ago
  I find 1Password to be sort of a pain when signing up for new accounts on my iphone – the generate secure password & autofill doesn't always work for me – on the web it's great though
- Hamuko 4y ago
  I considered 1Password when shopping around for a new password manager, but the pricing of the subscription and the fact that it was an Electron app killed it for me. Currently test-driving a smaller alternative with a one-time payment.
ElijahLynn 4y ago
One problem with that is if a person has a non-Apple product, Apple won't build the app cross-platform, so they are even further locked into Apple hardware then. Might not affect that many people. But it would surely limit choice for those who don't even know about the lock-in later in their lives.
- m000 4y ago
  Any attempted lock-in is guaranteed to attract attention of EU regulators. This is what Apple probably wants to avoid. They won't be allowed to play a "Safari" this time (i.e. all password managers are allowed, as long as they are a frontend to our own password manager). Also, having the password manager as a separate app, it is likely they will be asked to provide a standalone password migration API for third party password managers. This would make switching to another ecosystem trivial for moms & pops, who currently need to deal with CSV import & export* if they want to move their passwords out of iCloud. * Not sure what the situation is ATM, but a few years back exporting passwords from iCloud was not directly supported. I had to run a third-party AppleScript script to generate a CSV to import in another password manager.
Anechoic 4y ago
Keep a “Notes” field where you can add extra data, like 2FA backup codes, for each password! I'm not sure if the reference here is to Keychain's "Secure Notes" or the "comments" field associated with password items. If the latter, I've found (at least on older versions of OS X/macOS) that when Safari updates the value of a changed password, it deletes the comments! I used the comment field to add the (random) answers to security questions, and got burned on a couple of sites when I've needed to do an account reset and lost those answers.
- shagie 4y ago
  > that when Safari updates the value of a changed password, it deletes the comments! It doesn't change a password, it creates a new one. This means if you somehow mangle saving the password (you thought you updated it, but didn't) the older password is still in your keychain with the older note and it can still be retrieved.
w-m 4y ago
Tangentially related, something that has slightly inconvenienced me a few times: Can someone point me to a setting to get Siri to show me my passwords again, on iOS 16? Before, I could ask on an unlocked phone to “show me my password for GitHub” and Siri would open the settings app with the password list and show the GH credentials. Now (since iOS 16?) Siri just refuses to do any request that contains ‘password’.
- selykg 4y ago
  You mean Shortcuts? You can have it open this URL: prefs:root=PASSWORDS You'll want to set up Siri separately as part of it, but you can definitely do that with Shortcuts.
  - w-m 4y ago
    Interesting, thanks! What I described didn’t need a shortcut before. It was a vanilla iOS feature. I assume it went away for privacy reasons with one of the OS updates. And hoped there’d be a setting to get it back.
DantesKite 4y ago
I get the impression Apple doesn't want a dedicated app for passwords because they don't want people to think about passwords. It shouldn't be something people manage, hassle, or worry over. They likely want people to just be able to open their phones and have it uniquely identify them seamlessly across a variety of sites. Unfortunately, they're not quite there yet.
- ElijahLynn 4y ago
  Good point, the end goal is probably some sort of biometric MFA solution.
- CharlesW 4y ago
  > I get the impression Apple doesn't want a dedicated app for passwords because they don't want people to think about passwords. I think you're right. Ventura's Passwords Settings shows that they're in transition away from the archaic Keychain app to something. My guess is that they're skating to where the puck will be in 2025 when Passkeys are universally supported, and for most use cases auth will be automatic.
rohan_ 4y ago
>(And it all syncs across your devices, for free?!) IMO the worst part about apple keychain is they can't be used with Chrome (the most common browser for mac!)
- sargun 4y ago
  I believe this is as much on the Chrome side as it is on the Apple side: https://bugs.chromium.org/p/chromium/issues/detail?id=312105 https://bugs.chromium.org/p/chromium/issues/detail?id=312105 Chrome could access those natively on Mac, or use the keychain as the native backing store, from what I can tell.
- apike 4y ago
  I too find this frustrating, but I’m curious about the claim that Chrome is the most common browser on Mac. I sometimes see this claim, but I struggle to find any data to back it up. The US government web analytics (https://analytics.usa.gov/data/ https://analytics.usa.gov/data/), which seems like a reasonable source for general usage in the US, show Safari substantially ahead of Chrome on Mac. Have you seen any sources that show Chrome ahead of Safari on Mac for a general audience?
- fckgw 4y ago
  You can, Apple has an extension for iCloud Keychain. https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en https://chrome.google.com/webstore/detail/icloud-passwords/p...
  - snowwrestler 4y ago
    > iCloud Passwords is a Chrome extension for Windows users…
  - rohan_ 4y ago
    Windows only
defulmere 4y ago
Every time I see a question like "Why doesn't Apple build $THIS?" I assume the answer is "because they'll make more money selling 3rd-party $THIS in the app store".
- culturestate 4y ago
  > I assume the answer is "because they'll make more money selling 3rd-party $THIS in the app store" Apple has a long and storied history of doing almost exactly the opposite - any sufficiently popular third-party utility either gets bought and integrated (eg Workflow, Dark Sky) or Sherlocked (eg f.lux, Watson). Apple takes a very long-term view of revenue generation, and the App Store commissions from $random_app are way less valuable to Apple than the LTV of a customer who’s locked into buying Macs and iPads because of Apple’s proprietary version of $random_app.
richardw 4y ago
You should see the horror that is changing your country and phone number. I spent weeks hunting around the phone to stop weird things from happening. You would think Apple were smart enough to say “it looks like you’ve changed details. Can I update the plethora of places I use your number?”
imchillyb 4y ago
Until Apple’s keychain works reliably across all platforms, I’ll continue to use Dashlane Password manager.
AdamGibbins 4y ago
Edit: Removed initial comment, confused my iOS faults. Keychain its current configuration is risky, given its coupled to your iPhone password which many people frequently enter in a public setting. One shoulder surf followed by a phone theft and they've unlocked everything - including your iCloud account (which you can change the password on using iPhone password only).
- buildbot 4y ago
  It needs biometrics or passcode to unlock?
- Jaxan 4y ago
  > you can access it when your phone is unlocked without any additional authentication. No you can not. On my iPhone I have to authenticate with my finger print or pin code again for the passwords.
- azinman2 4y ago
  If I go to system settings > password on iOS, it then requires Face ID to get in. So I’m not sure what you’re talking about. Under Face ID & passcode you can also require Face ID for a password auto fill. So I don’t think any of this is correct.
  - sabin1001 4y ago
    [dead]
- simonklitj 4y ago
  Are you sure? I always have to scan Face ID, whether it's to open the "Passwords"-section in Settings or to have it automatically paste a password on a website/app. How do I access these things without additional authentication?
twobitshifter 4y ago
Anyone know how to use Microsoft otp with another app?
sabin1001 4y ago
[dead]
izolate 4y ago
I switched to Apple's password manager after being burned by Twilio Authy's inability to retrieve the 2FA setup codes. I wish they had made this lock-in more clear. Overall I'm happy with my decision. I'm now even using Safari over Chrome full-time because it has the benefits 2FA autofill. Only thing missing is a dedicated app, but I have Apple Shortcut that works well enough in the meantime.
monocularvision 4y ago
Am I the only person on Earth that needs sharing of passwords among my family? Any time folks bring up password solutions, they are always missing this requirement for me. 1Password is a life-saver in this regards. All my kids have their own vaults but for the little ones I have them use a shared vault between my wife and me so we have access to their passwords. I can also easily share passwords for services like Netflix so the kids don’t have to bug me. It has been great for teaching kids about password hygiene (what makes for a good password) and management (don’t reuse passwords!). And it being cross-platform is great for my older kids with gaming PCs.
- e40 4y ago
  1Password with son, wife, father and mother... life saver.
- ellisv 4y ago
  I agree that is one of the big issues with keychain. You can share keychain items with people but it is awkward.
  - jtbayly 4y ago
    Are you referring to Airdrop password and passkey sharing?[1] That’s the only way I can find other than manual copy/paste. Also, I very much doubt if I later change the password I shared via Airdrop that it will update on the other person’s device… which is half the point. [1]: https://support.apple.com/guide/iphone/share-passkeys-passwords-securely-airdrop-iph0dd1796bb/ios https://support.apple.com/guide/iphone/share-passkeys-passwo...
    - ngai_aku 4y ago
      Yeah, that’s how I share with my wife. I don’t anticipate that it would stay in sync if I updated it, but I can’t say that I’ve tried. Do you regularly rotate passwords?
      - jtbayly 4y ago
cmnt 4y ago
It's incredible how Apple make it's users happy to lock-in in their eco-system. I don't really know Apple eco-system but it seems weird to migrate from tierce app (already well integrated) like Bitwarden to keychain. I've lost count of the people who have switched from their Music App to Apple Music for no reason other than "it's Apple". Apple make good hardware and their eco-system seem amazing too, but people should see the advantages to be not entirely depedent from a company.
- deergomoo 4y ago
  > but people should see the advantages to be not entirely depedent from a company I think you're overestimating how much the average person thinks or cares about their computing platforms. They want something that works and gets out of the way, and to that end having everything come from one company is a feature, not a bug. I mean I consider myself a power user and I still use iCloud Keychain purely because I was already using Safari when it launched, so it already had all my passwords. I recognise the advantages of third-party offerings, but to me they're not enough to bother moving all my stuff over. Similarly I still use a third-party 2FA app because I was using it before Apple added it into iCloud Keychain (and also because the third-party app has an Apple Watch app and I've grown accustomed to reading the codes off my wrist).
stalfosknight 4y ago
That app is called Keychain Access on macOS.
geuis 4y ago
I really want to use Keychain for all of my password management. But nothing works. Like I'm in serious need of a highly secure cross browser/cross platform password solution. On my phone, everything is fine. But I use Chrome on MacOS and my Windows desktop. Chrome used to use Keychain on MacOS, but some years back Google changed the product to tie into their own user accounts. I refuse to sign into a browser itself just to use the web. The iCloud password extension for Windows (chrome/edge) absolutely DOES NOT WORK. I have tried getting it to work for the better part of a year. Finally gave up and removed the useless thing. I probably dumbly still trust Apple's security policies and would prefer to use Keychain as my fits-all-sizes security tool, but the combo of product incompatibilities and non-working Apple authored software makes it impossible.
immdischt 4y ago
The article is informative but failed to describe where to find Apples password settings / feature while complaining about how hard is is to find…
thiht 4y ago
I'd never use a password manager built by Apple for the same reason I don't use Chrome's password manager or Firefox's password manager. All these passwords managers have strong incentives for "working best on <platform>™". I want a password manager independent from any platform like Bitwarden or 1Password, because it's actually valuable for THEM to target all the platforms they can.
- sowbug 4y ago
  I don't understand. Chrome and Firefox don't have platforms. Which means they run pretty much everywhere they're allowed to. Apple is the only one of those three that restricts their software to hardware that only they sell. So in that case I do understand your position.
  - HeavyFeather 4y ago
    > they run pretty much everywhere they're allowed to. Yep, they’re allowed to run on Chrome, that’s Google’s platform. Good luck using your Chrome/Google passwords outside Chrome/Google apps. Firefox at least does (or used to) offer a Lockbox app to use the password on your phone.
  - thiht 4y ago
    A browser is a platform. I have no easy way to use passwords saved in Chrome in Safari for example. It matters to me because I use Firefox and Chrome on my work desktop, Safari and Firefox on my personal desktop, and Safari on my phone. And I want the ability to switch browser easily. Same goes for Apple passwords, I still use Windows for some games, and I want to access my passwords easily.
- HeavyFeather 4y ago
  The problem is that the integrated managers really do work best on platform, i.e. alternatives aren’t nearly as well-integrated. So here I am using Safari on my computer and phone.
- deleted 4y ago
  [deleted]
tacker2000 4y ago
The worst thing is when I register a new password to a website on my Mac on Firefox and then want to login to the site on my iPhone. I literally have to type the (complicated) password again so that it gets saved in Keychain. Why wont Keychain allow Firefox sync? This seems like an extremely common use case.
pantojax45 4y ago
I wish you could add a second password or different passcode on top of iCloud Keychain / apple passwords. I get nervous at how easy it is to compromise all passwords: 1. Give someone your phone passcode, they can change apple account password. P0wned 2. Have iCloud Keychain on laptop… other user account resets password on account. (Or use it on work computer without realizing) 3.
- nytesky 4y ago
  Turn on screentime and prevent account changes with a 2nd PIN Might also limit password changes but unsure.
aquanext 4y ago
My best guess is that Apple won't do it because their plan is to phase out passwords entirely. That's what that whole FIDO Alliance (https://fidoalliance.org https://fidoalliance.org) is all about. And 1Password is part of that too: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all... I think that ultimately a password tool needs to be available on multiple platforms, like 1Password. Having it just be on Apple stuff just isn't gonna work for the many Windows and Linux machines I begrudgingly have to interact with.
- ttul 4y ago
  1Password knows that it will take centuries for passwords to disappear even if a password-less future is already here.
  - Hamuko 4y ago
    Passwordless future definitely wasn't here just 1-2 years ago. The management of WebAuthn Discoverable Credentials / Resident Keys was so fucking awful on every platform I tested them on. You want to clear your Resident Key for a website on Windows? Command-line.
  - judge2020 4y ago
    1Password has embraced it: https://blog.1password.com/passkeys-are-coming-to-1password/ https://blog.1password.com/passkeys-are-coming-to-1password/ While I'm not sure how they've integrated it so far, I imagine browsers will either implement a plugin API for extensions to handle passkeys, or 1p can override the webauthn api and fallback to the browser when a website is authenticating.
kup0 4y ago
Not sure we want to ask Apple to build more software when they can't even get the quality of their existing software up to par. I would be strongly inclined to stick with something less tied to the platform/ecosystem, like 1Password
404mm 4y ago
One core feature that will keep lot of people from using Apple Password manager is family setup. Anyone with Apple family knows how bad it can be when you have dozens or hundreds of shared passwords between you, your spouse and / or kids.
- rootusrootus 4y ago
  Yep. 1Password has my business indefinitely because of this requirement. Apple may be building a nice solution for single people (and perhaps many non-parents), but it's useless for family use.
pharos92 4y ago
100% - the current method of access (via settings) is so nu-intuitve. A real sign of the state of Apple over the last few years. Customer UX needs to become front-and-centre again.
sholladay 4y ago
I don’t personally care much whether Passwords is in Settings or a separate app. But I do have one problem with it. As far as I can tell, you must save a password for a site in order to use the TOTP 2FA feature. I don’t want my device filling in passwords for me because it defeats the purpose of a password being “something I know”. The 2FA code is more like “something I have” and I’m okay with the device filling that in, but not the password. There doesn’t currently seem to be a way to set up only the 2FA code for a site.
- shortcake27 4y ago
  The “something you know” is your devices pincode/passcode/iCloud password, not the password to the website. If you know the password to a website it means you’re reusing passwords or using a pattern to generate passwords, both of which are less secure than randomly generated passwords (especially the former). Of course, nothing is stopping you from saving a bogus password either.
  - sholladay 4y ago
    I don’t buy it. Complex, random passwords are great against brute force attacks but that’s not usually how these things play out. Many password breaches are caused by technical lapses on the part of a platform, where password complexity often becomes irrelevant. Your password gets hovered up along with everyone else’s and eventually gets decrypted, and tried en masse against other platforms. In this scenario, even a simple pattern for passwords is probably enough to prevent the problem from spreading, as long as it’s not too obvious. The other way passwords often get compromised is from someone looking over your shoulder or key logging, infrared on PIN pads, etc. In this scenario, your system is WAY, WAY worse, since one password unlocks the kingdom, and that password is frequently being used. As it stands, if someone peeks over my shoulder and discovers my phone password, then steals my phone, it’s damaging but not game over. They can’t access any websites. If I allow my phone password to be the only gatekeeper to access everything, IMO that’s lousy security.
cglong 4y ago
I appreciate Apple adding the ability to export your passwords, but it's ridiculous it took until 2021 for this to happen.
alana314 4y ago
They don't make it clear on iOS which password manager you're using, which hurts both them and other password managers I think. The worst experience is not knowing where your password is or which account it's using. I had to turn off all apple password management in preferences, I've thought about going all-in on apple passwords but don't think it has all the features I want.
sacnoradhq 4y ago
This is unnecessary because it's a problem that's already solved. - BitWarden - for personal use, stores 2FAs and acts as an iOS password source. (The claimed attacks were mitigated) - Keeper - for enterprise use, stores 2FAs and acts as an iOS password source - Duo - for 2FA for enterprise use with backup text mechanisms. Edit: Duo's primary app mechanism is similar to Google Gmail app's mechanism of a yes/no popup to approve a 2FA request ^ The above are cross-platform and extend beyond Apple.
hot_gril 4y ago
I've been using Keychain since 2003. Only now am I aware that it does TOTP. I've been avoiding TOTP like the plague this whole time because I don't trust the other apps not to somehow get me locked out.
- hot_gril 4y ago
  (Especially Google Authenticator, especially the original version where they said it's WAI that you can't transfer codes across phones. Keep that nerd stuff away from me.)
r0m4n0 4y ago
I think a few problems imho: 1)they don’t do cross platform software well so they would never make a windows app, chrome extension, android integration etc. It’s either all or nothing which I would never buy into (even as an iPhone and mbp user) 2) there are actually a ton of use cases here that make the software actually very complex and high stakes. I’d wager the pros don’t outweigh the cons. Also apple isn’t known for complex software with niche use cases. Honestly their current safari/iphone password manager is trash They do a few things well and rely on lock-in and ecosystem
mperham 4y ago
It seems apparent that Apple are investing in Passkeys as the future and passwords are legacy infrastructure in a sense. https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...
thom 4y ago
Gimme something to make family passwords easy (eliminate passwords!) Enable Apple ID logins for kids. Throw your weight around to move safety settings into some sort of open web standard. I’ve got 1Password but the daily pain of managing a family of users with various accounts is just too much right now and I would pay almost any amount of money to have a simple solution that I never had to think about.
- noizejoy 4y ago
  Have you seen this? https://arstechnica.com/information-technology/2022/10/passkeys-microsoft-apple-and-googles-password-killer-are-finally-here/ https://arstechnica.com/information-technology/2022/10/passk...
gumby 4y ago
The nice thing is: the way they implemented this it looks like you could pretty easily write a 1passwordish mac client as an interface to the system infrastructure. I say "1passwordish" because one of the tedious part of a program like that is the browser parsing to handle all the weird authentication cases devs write. Unfortunately I'm not an ios dev and wonder if it might even be possible to do the same on ios? I believe there is an API so you can write a password manager (1password et al use that) but can you get to the secure system services? Edit: I now see who wrote this blog post. Were it straightforward on ios he probably would have said so.
- frutiger 4y ago
  I am not an expert macOS/iOS developer but I unsuccessfully played around with the API a couple of times. You can’t access passwords stored by another app (app identifiers appeared to be globally unique, e.g. com.apple.Safari). There was an additional hurdle to access/store items in the iCloud keychain, though I forget what exactly. This restriction makes sense.
muhammadusman 4y ago
I resisted using 1Password for a long time but then once I got into the 1P world, it was better than all the alternatives. LastPass is unsafe, Dashlane has subpar experience, and all the proprietary ones are missing tons of features. Chrome, Firefox, Apple, I'm sure Windows too, have all their own password managers and all of them are hard to use and expect you to only have devices in their ecosystem. 1Password is worth every penny for how well they've kept up with updating their apps and their prevalence on all platforms. And the 2FA integration is great too!
vbezhenar 4y ago
I tried to use Apple passwords. 1. It really hates storing anything but website passwords. I have servers with ssh login/passwords. I have bank cards with cvv and pins. I have phones with pins. WiFi passwords. And other things not fitting to website/username/password. 2. Not enough fields. I'm ascetic when it comes to storing passwords, but it doesn't even have "notes" field. So experience is subpar. It's possible to emulate some things, but in the end I decided to go with StrongBox. It's not ideal, I don't like UI, but it has all the functions I need. I also like KeePassium, but it's missing sync and mac app. I know that Apple KeyChain has secure notes, but those are not accessible on iPhone, AFAIK.
- kstrauser 4y ago
  It does have a notes field now. I’m not sure when that was added.
permo-w 4y ago
my issue with apple passwords is that you literally cannot put a password on them. iPhone forces you to use biometrics as your key for them. whatever you think about passwords vs biometrics, the fact that I literally cannot choose is ridiculous and a massive oversight
- r00fus 4y ago
  Biometrics or your device passcode. My mom has a touchid phone (won't get the faceid due to paranoia) and she gives up on it during winter when her fingers get cracked due to the heating. So when she logs into the device it always falls back to device passcode. I am frustrated they won't allow you to do both bio+code, because that would prevent my kids from flashing my pilfered phone in my face to get it to unlock then running away.
mzmzmzm 4y ago
Tangential but I hate that Mozilla abandoned their password manager app that uses the sync service they still maintain, instead of adding a TOTP/OATH feature and giving people a better and more open option than Duo and skeezy password managers.
cush 4y ago
One word. Liability
theden 4y ago
I recommend https://strongboxsafe.com/ https://strongboxsafe.com/ as a better open source alternative Works with touchID on my MacBook, uses KeePass so it's easy to migrate if needed, and the killer feature for me was being able to sync it to iCloud so you can use it across devices. Even better if you enable E2E encryption on your iCloud https://support.apple.com/en-au/HT212520 https://support.apple.com/en-au/HT212520
- faeriechangling 4y ago
  It's a good piece of software for what it is, but the tool is .kbdx based and like all such solutions tends to handle shared secrets rather poorly. It also handles adding new secrets for new accounts less elegantly than Apple's own built-in password manager which has a nice flow for adding anonymous forwarding email addresses and contact details for new accounts so long as you commit to the cult of iCloud. Still if you need a multi-platform password manager that performs well on Apple devices there's nothing I can recommend since you can just use .kdbx tools on other platforms and strongbox itself has highly reliable multi-cloud sync, extremely fast input of secrets, a better security model than keychain itself has, and even has MacOS Chrome support (abliet hacky support) if you feel like trusting the plugin. It makes Bitwarden and other Keepass clients feel clunky in comparison.
rtpg 4y ago
I think icloud is pretty decent as a solution, but one thing I think is kind of worrying is that it unlocks with the same "key" as your phone. So if someone sees your PIN code, they can not only unlock your phone, they can get all of your passwords and change those passwords very quickly. I enjoy 1Password being separate in that regard, and I would really like it if the iOS keychain would let you set a separate password in that respect.
chrisfinazzo 4y ago
I might argue instead that simply having Passwords as another item inside Settings is appropriate for what functionality it exposes. It's a feature, not a product, doesn't do everything that Keychain Access does in macOS, and doesn't need (or deserve) to be in your face all the time. Do keyboards/wallpaper/voip apps/whatever really need to have their own app icon on your homescreen? Probably not, but Apple's conditioned us over the course of 15 years that all apps have icons you can see - a view at odds with things like Fantastical and SwitchGlass, which are really "apps that run in your menubar" and can be used without a Dock icon at all. iOS doesn't have the concept of "Utilities" within "/Applications" like macOS does, but maybe it needs to in order to address this class of app which has such a specific focus. After 15 years, are we at a point where some of the early affordances aren't neccessary anymore?
- HeavyFeather 4y ago
  Do you really need to go back to your car, open your trunk, get the wallet just to show your ID? Passwords are my ID, sometimes I have to enter them onto another computer or app or just share them with someone; I shouldn’t need to hunt my ID in the trunk of my car. Keychain Access did this right decades ago, so there’s some logic behind it. The issue is that the app is not built for this decade and its UI is lacking.
pyuser583 4y ago
Lots of apple “settings” deserve an app.
tap-snap-or-nap 4y ago
At this point, the whole password based infrastructure needs a revamp.
willhackett 4y ago
I'm all for this, a better cross-platform Keychain app would be awesome. To get my Credit Card details, I need to go Settings > Safari > AutoFill > Saved Credit Cards. To get 2FA / Password details, I need to go Settings > Passwords. In a lot of cases, they auto-fill without issue. But to manage these is a bit of a flimsy process.
imWildCat 4y ago
Don't put all your eggs in one basket. Don't put all your passwords into one single software provider.
dbg31415 4y ago
Apple would put 0 effort into making the app work across platforms and browsers and devices. They're not a good fit for this space.
bert2002 4y ago
The goal is to go passwordless.
AnonC 4y ago
Perhaps this is one of the “user requested features” Apple is going to implement in iOS 17 and its cousins? As per a recent and vague rumor, Apple is going to add more user requested features and is adding them late in the development cycle. [1] It would be great to have a nice UI for managing passwords, 2FA codes, etc. Add password sharing over iCloud and it could be a game changer! [1]: https://www.macrumors.com/2023/03/26/ios-17-to-provide-several-most-requested-features/ https://www.macrumors.com/2023/03/26/ios-17-to-provide-sever...
altitudinous 4y ago
I agree (and its not often I agree with folk on Hacker News), Apple provide a far superior password service inside a far inferior UI. The handling of authentication codes is particularly great in the Apple ecosystem, but very poorly promoted. For a company that markets itself as secure these are retrograde steps.
crossroadsguy 4y ago
Apple needs to fix iCloud (or anything where a sync/etc is required) to something that’s at least reliable and transparent from the 2023 standards! Period. As of now it’s so poor if not downright broken. Because without that everything on the software side by Apple will just remain glorified things that the fans keep bleating about - “just works”, “is perfect”, “just what I need”. For heaven’s sake Apple does a shoddy job of syncing et cetera and obscures it from the user in the guise of usability and that “Apple knows what users need to do”, not what they want.
Bondi_Blue 4y ago
You can always make a Shortcut to open the Passwords section of System Settings. And put that in your dock or wherever.
kjto 4y ago
what about https://authy.com/download https://authy.com/download? mobile/desktop/cloud sync, free...
hollowturtle 4y ago
I did a new mac setup recently and just discovered, after many years of use, that I cannot use 1 Password 7 anymore :( The app works it’s just they’re phasing out the browser “classic” extension with the excuse(?) it won’t work with the new manifest v3, so a migration to 1 password 8 is required. I hate their subscription model and I think I’ll self host bitwarden, but was also considering the system password manager, or the one builtin into Firefox. Problem is passwords won’t leave the browser ecosystem in this way and it’s more often than not that today you need to move password cross platform and cross device. So I don’t see an apple password manager as the best solution, they usually stay inside their walled garden
- Jolter 4y ago
  For your preferences, I’d propose Keepass. Maybe you’ve already looked into it.
yomyogd 4y ago
There's bitwarden that does it all, cross-platform and completely free.
markkvdb 4y ago
The password managers ("Passwords" and "Keychain Access") seem deliberately limited. A few issues that I noticed: The discrepancy between the "Passwords" and "Keychain Access" app. Passwords manages 2FA codes whereas Keychain doesn't. Keychain allows you to add another URL for a password whereas Passwords doesn't. The latter issue often leads to headaches dealing with passwords when the URL of the login page is not the same as the URL for the second part of the 2FA. An example that became unnecessarily frustrating. Heroku makes you login to dashboard.heroku.com but the 2FA code needs to be filled in at a salesforce URL. Since I can't add this salesforce URL to the existing password (+ 2FA code) I have to manually copy the code. The shortest routine I found for that is: 1. CMD+Space. 2. Enter "passw". 3. Click on the search bar. 4. Enter "Heroku". 5. Click on the password. 6. Go back to the web page to enter the displayed code. Simply having the option to add another URL (which was possible in Keychain Access) would solve this entire issue...

1260 points by ttepasse 4y ago

i would prefer icloud keychain allows an alternative password - i refrain from adding some credentials to the keychain since my passcode is easy to steal?

isleyaardvark 4y ago
Reading other comments in this thread and I feel like I am taking crazy pills. There was a big article that I thought a lot of people had read and would realize having passwords saved under an iCloud account is a recipe for disaster, since only a phone passcode is necessary to gain full control of an iCloud account. https://news.ycombinator.com/item?id=34984821 https://news.ycombinator.com/item?id=34984821

ajani 4y ago

> Passwords are productivity, not preferences. Surely passwords are security?

cramjabsyn 4y ago

I agree it could be more polished but there is an app called Keychain Access that does give reasonable access/search/management of icloud passwords

robinhood 4y ago

I'm okay to move my photos to Apple. I'm okay to move my music. But I'm not ready to move my passwords and tie them to the Apple ecosystem. 1password for the win.

TheRealDunkirk 4y ago

Regardless of how great they might make an interface for it, passwords are the last thing I haven't given to Apple. If I lost control of my Apple ID, it would be a disaster, but at least it wouldn't expose everything else as well. I have a hard time getting over this mental hurdle, so it's 1Password for the foreseeable future for me, no matter what they do here.

adultSwim 4y ago

Passwords stink. I want to think about them less, not more.

Despegar 4y ago

I guess everyone is over the anti-"self-preferencing" policy push over the past few years and is back to normal. Sherlocking is in fact good.

cjdoc29 4y ago

I really like Apple's implementation of passwords, passkeys, etc. But...I had a hard time explaining this to my mom. She uses it to generate her passwords and fill-in within Safari which is great! But there's no "Passwords" app, and she didn't know to go into Settings to reference a password when Safari doesn't recognize a password field (probably the website's fault). 2FA is also a confusing experience, but 2FA is also just confusing enough for her where Apple isn't really the problem here.

reaperducer 4y ago
But there's no "Passwords" app It's called Keychain Access.
- cj 4y ago
  The problem is Keychain Access doesn't pass the "mom test" (would you average consumer - e.g. your mom - actually use it)
  - airstrike 4y ago
    They don't even know why it's called that
    - shagie 4y ago
      Because you can store non-passwords in there too. Secure notes, your own signing certificates, keys, root CAs, and specific self signed certs you've accepted for SSL.
      - airstrike 4y ago
        Still, none of that means anything to the average user. Searching for "passwords" in Spotlight should also take you to your passwords
        shagie 4y ago

isoprophlex 4y ago

What the actual flying fuck, the apple password thing supports TOTP! That's great! (And a sad testament to how poorly the discoverability is on some ios features)

brycedriesenga 4y ago
Isn't it considered not great to do TOTP and password storage in the same place?
dwaite 4y ago
Not just that, they will detect QR code images to work around sites which assume that TOTP is only available by scanning your desktop screen from your phone.
- matt-attack 4y ago
  Can you provide an example website that uses this technology? Not sure I've ever encountered one.
  - deleted 4y ago
    [deleted]
  - Gigachad 4y ago
    Uh, basically all of them? They all show a QR code and never show you the secret which you could copy in to your password manager.
- kitsunesoba 4y ago
  Step Two[1] also does this, which is one of the reasons I've been using it for TOTP for the past few years. Nice to see that the built-in TOTP support can do that now too. [1]: https://steptwo.app https://steptwo.app

hnrodey 4y ago

I tried going all-in on using iCloud Keychain (correct term?) for my passwords from having previously used LastPass. In short. 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable. 3. The GUI is buried in System Settings. Heaven forbid you need search it's only a simple 37 clicks away! I think those were my big complaints. If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired.

grammers 4y ago
Sounds like vendor lockin is the aim here, not being fully cross-platform without any hassle.
chakintosh 4y ago
> 1. The experience on Windows is terrible. They can claim it's cross-platform but it's truly a sub-par product. Ditto. Why do I have to replace my Windows login password with a "PIN" code that's the same as the iCloud Keychain PIN !? That's super weird!
AdmiralAsshat 4y ago
> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working as designed."
- lozenge 4y ago
  With passkeys, now every platform can enjoy this level of lock in!
  - rootusrootus 4y ago
    I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.

OCISLY 4y ago

I still miss Mozilla Lockwise.

benatkin 4y ago
At least Firefox makes it easy to view your Firefox passwords. In Chrome it's nested in settings and the text box where it shows the password is tiny.

mattkevan 4y ago

I've always used Keychain Access to view/manage passwords. If they cleaned up the UI a bit it'd do pretty much exactly what Cabel is talking about here.

teabee89 4y ago

I will tell my family to use iCloud Keychain the day when it works across all major browsers and OSes. Or at least that they provide an API to sync with other password managers.

galad87 4y ago

They already have an app, Keychain Access, but for weird reasons they integrated the new features into System Setting instead of expanding the existing app.

waboremo 4y ago

Fully in agreement here, getting people used to Apple Passwords can be a task purely because it's stuffed into settings. Would like to see them in the process of transitioning it away from settings, also include the ability to change the name of the entries. Multiple URLs per login would be great too (or even a linking of separate entries). Think these are the biggest things keeping many general users still relying on the likes of 1Password/Bitwarden, which is where I disagree with the writer here, I think third party password tools should be replaced by sane defaults as soon as possible outside of niche cases.

dwheeler 4y ago

> And it all syncs across your devices, for free?! Really? My Linux devices? Android? Windows? I don't think so. I recommend considering one of the most important features of a password manager is that it doesn't force you to use a single manufacturer's products forever. Even if you swear undying fealty to Apple (or anyone else) today, you might change your mind in the future. 1Password, Bitwarden, and others allow me to switch PC manufacturer, phone manufacturer, browser, and so on. I can't tell you how many people used to think "Internet Explorer is popular, it'll always be the one and only browser". That did not end well.

geocar 4y ago
> Even if you swear undying fealty to Apple (or anyone else) today, you might change your mind in the future. Changing my mind is easy enough: I can export my iCloud passwords to a csv file, and I've done this to transfer a bunch of passwords to Firefox Linux desktop. I'll tell you something though: If Bitwarden leaked passwords nothing would happen because America has very weak consumer protections, but if Google or Apple leaked passwords, they'd be hit in every EU member state for GDPR. Some of these things are outside of my control, and using a password manager is too useful that I think it's worth a little risk, but I can't justify trusting any company unless they've got some skin in the game, and Bitwarden specifically wants to disclaim all liabilities? AgileBits thankfully is in Canada and you can at least sue them for what you've paid them in six months, but I personally have passwords more important than that. Surely there's someone else you could recommend?
- error503 4y ago
  Self-host vaultwarden at the cloud provider of your choice?
  - tasuki 4y ago
    What is the point of this? Isn't it easier/simpler/better to just sync a file with the passwords rather than keep a server running?

elsurudo 4y ago

I use Keychain Access app, but admittedly the UX there is terrible. I wish it was nicer, and also integrated with browsers other than Safari.

Schiendelman 4y ago

I think the reason Apple hasn't prioritized this is that with their login with Apple implementations and passkeys, the utility of copying/pasting or looking up a password is dropping over time.

aeharding 4y ago

You can make an iOS shortcut to make it appear as an "app" (launches keychain manager). I did this for some elderly folk, works great.

CryptoBanker 4y ago

Oh god please no

tikkun 4y ago

While we're on the subject, other Apple things that deserve an app: Dashboard/status - I have a smart lock, and they have their own app, where all it really does is show the current status of the lock and let me toggle it. There are quite a few apps like this. It'd be nice if they could all be condensed into a dashboard/status app that could just tweak values and show current status. Apple Home attempts to do some of this. Notifications - It'd be nice if there was a notifications app, and I could set most of my apps to deliver their notifications to that app, instead of me directly. This would reduce notification overload and distraction.

Spivak 4y ago
Isn't that first one Home/iHome/HomeKit whatever you wanna call it? If your lock doesn't support HomeKit there's a good chance Homebridge does.
WorldMaker 4y ago
Have you tried Notification Summaries yet? That's sort of like a "deliver notifications to a separate app". In the notifications settings you create at least one Scheduled Notification Summary. I've currently got ones setup roughly every four hours during "core daylight hours" for me, plus I enable the "preview option" to read the next summary early if I need to. Then you add as many apps as you want to the Notification Summaries. All of the notifications for those apps during each time period get rolled up into a single Summary object in your notifications, only give a notification alert once for the entire group of them (at the scheduled time), and don't cause Watch notifications (if that's a distraction/overload you especially juggle as I do). At this point I've even got all my email notifications going into Summaries (which is why I turned on the preview for the next summary if I feel like I need a quick glance at recent email subject lines without opening my email app up). It is such a useful tool and not a lot of iOS users discover it in the settings. May also be an indicator that it could use its own app because discovery in the Settings app itself is hard. Maybe the Settings app is just doing too many things now and needs some sort of reorg or something.

aaronharnly 4y ago

I follow Ricky Mondello, who works on the Apple password keeper functionality — they post interesting tidbits pretty regularly. https://twitter.com/rmondello https://twitter.com/rmondello https://hachyderm.io/@rmondello https://hachyderm.io/@rmondello

selykg 4y ago
I met Ricky at a WWDC years ago when I was in the password manager field. What a wonderfully intelligent person. Actually, several members of the Safari team were present at that meeting and it was such a great set of people. I kind of miss that part of that job...
filmgirlcw 4y ago
+1 Ricky is the best. They also made a very useful Shortcut [1] that offers quick access to the Passwords on your Home Screen or Mac menubar. [1]: https://rmondello.com/passwords-shortcut/ https://rmondello.com/passwords-shortcut/
- shikshake 4y ago
  clicking this link throws a bunch of warnings in my browser, and my university internet blocks me from seeing the actual website :(
  - testfrequency 4y ago
    https://www.icloud.com/shortcuts/cd5b0ec116ee4d1d86548238394c1679 https://www.icloud.com/shortcuts/cd5b0ec116ee4d1d86548238394...
    - filmgirlcw 4y ago
      Thanks for that! My work machine blocks this too ironically, which is weird since Ricky is my friend and I know they are trustworthy. I’ll let them know.
  - deleted 4y ago

WorldMaker 4y ago

It took effort but I finally got my dad to use 1Password regularly, but my mom would be a lot easier to convince if Apple just made its own password tools easier to use, especially cross-platform, including maybe putting a nice app face on it. > PPS: I dream of a future where Passkeys could make the password manager extinct. But it’ll take time… Passkeys even more so need more of a "curated app experience" to work right, cross platform. Ironically, it is my impression that preparing for Passkeys is why Apple finally added that password explorer to Windows' weird iCloud "control panel". (For a long time, the only way to use iCloud passwords on Windows was the awful Edge/Chrome integration.)

kylehotchkiss 4y ago

internally, apple used to have a pretty big 1Password contract - https://appleinsider.com/articles/18/07/10/apple-looking-to-deploy-1password-company-wide-may-buy-out-apps-developer https://appleinsider.com/articles/18/07/10/apple-looking-to-... Maybe they don’t want to promote their own too heavily, to allow 1Password to take on the organizational risk of running a password manager? (For context, think about your current view of lastpass vs how you felt about it a year before their leak). Maybe the internal password management functionality is better suited to orgs which restrict third party apps?

arghnoname 4y ago
1password has features that are useful in a large corporation that keychain does not have, particularly around sharing passwords and password vaults. I haven't noticed even minimal credential sharing facilities in keychain.
- dwaite 4y ago
  WRT credential sharing, you can airdrop credentials to people on your contacts list. But multiple vaults and vault sharing - no such luck. I don't think they want to deal with the UX confusion of it, especially since that confusion could lead to someone getting locked out of things.

great_psy 4y ago

I have been using the Apple manager since LastPass got hacked recently. Hot take , but … I like the lack of integration in other operating systems/ browsers. I see my phone as a Secure Enclave, and my passwords should be disconnected from potentially insecure systems. I see the phone as those keychain one time passwords where you have to press a physical button to get a key. Is it inconvenient to get a password, yes. But it offers the piece of mind that I only have to worry about iPhone/Apple exploits, instead of chrome+firefox+windows+Linux+Apple+iphone. I don’t think in this case Apple is not doing the integration because of this security feature, but I think it is a feature non the less. Of course you can always choose not to install the extensions even if they existed, but the point is that if they existed it would lower security.

imwithstoopid 4y ago
don't lose or break your phone....
- MBCook 4y ago
  iCloud solves that.
  - whitewingjek 4y ago
    Unless Apple ever starts following Google's lead to ban accounts for any infraction and you don't store backups... Not saying Apple is doing that now, but I imagine it's not outside the realm of possibility.
    - great_psy 4y ago
      We can use the same argument for any other cloud password manager. If google/Apple blocks my access, well it’s those services I am trying to log into in the first place so the point is moot. Also I have recovery keys for the more important accounts printed and stored in a safe box.
      - 4y ago

kernal 4y ago

Setting up TOTP on an iPhone. I had no idea it could do this. https://support.apple.com/en-ca/guide/iphone/ipha6173c19f/ios https://support.apple.com/en-ca/guide/iphone/ipha6173c19f/io...

abraxas 4y ago

If Apple password manager is anywhere as well thought out as their 2FA for Apple TV then I don't want to come next to it within 10 light years. Every time it asked me to either "confirm on your iPad" (I have 3 of those around the house) or "confirm on your iPhone" (I have 0 of those) I was ready to hurl shit. SMS option buried in some dark pattern, of course. If these companies want to encroach in the secrets management space they really need to hire more qa and test more than a single happy path. The number of failure modes in these systems is astonishing for the billions of dollars these companies can throw at the problem.

Tepix 4y ago
I suggest you move to Ross 248, which is a mere 10.3 light-years away. However, 32000 years from now it will be the closest star to our sun at 3.024 light-years so keep that in mind!
twobitshifter 4y ago
I think there’s a setting for that in setup. Is your problem that Apple thinks you have a iPhone or that you have to interact with the tv on a second device? As with all things apple when you buy in you get the best experience. That feature on AppleTV works really well with an Apple Watch.
- capableweb 4y ago
  Which really sucks and puts you off from getting more Apple devices if you're a person who slowly buys into the ecosystem rather than go all-in without testing things. Personally, I was a fan of Apple laptops between something like 2010 - 2015, but after that I just couldn't deal with it anymore, as I had a Android phone and nothing else Apple. Fast forward to 2019, Apple finally releases a phone that fits in my tiny hands, so I get a iPhone 12 Mini, thinking that the CarPlay experience will be loads better than Android Auto on a measly Moto G. But holy smokes if I wasn't wrong, CarPlay is a UX disaster and I can't wait for the iPhone to break somehow or get too slow because of OS upgrades, so I can justify buying a new phone again. Just the simple fact that a phone calls covers the entire screen (which I use for GPS) seems like such a simple use case that they somehow missed, that I just wanna bin the entire system and I'll never buy Apple hardware for daily use again. I still have to use Apple laptops for software I release, but every time, I'm reminded how great the UX used to be, but how far they have fallen. Really sad to see. Windows is no better either, each version gets worse and worse...

sylens 4y ago

Even if macOS and iOS are my primary work (and personal) platforms these days, I still like a solution that works great on Windows, Linux, and Android as well. I'm pretty happy with 1Password - it does all of the things mentioned in this article with more platform support

ehsankia 4y ago
Exactly, this is why many of the Apple services are useless unless you are 110% in their ecosystem. At least Apple Music is the one app they somehow made available on Android and Windows.
- mmmmmbop 4y ago
  There's a feature on the AirPods that allows you to enroll them in your iCloud account enabling Find My. All you need to do is connect the AirPods to an iCloud-enrolled Apple device, and it will automatically connect to that iCloud account. Oh, but it's not any iCloud-enrolled device, it must be an iOS device. Connecting them to my MacBook didn't do anything. I went into the Apple Store to ask for a solution to that problem. They legitimately asked me why I'm buying AirPods if I don't have an iPhone -- they're called Air Pods after all... Anyway, their proposed solution was for me to buy a refurbished iPad for $450 to connect the AirPods to my iCloud.
- cglong 4y ago
  Apple Music started its life as Beats IIRC, so a good cross-plat UX was part of the acquisition. See also Shazam.
lfciv 4y ago
I find 1Password to be sort of a pain when signing up for new accounts on my iphone – the generate secure password & autofill doesn't always work for me – on the web it's great though
Hamuko 4y ago
I considered 1Password when shopping around for a new password manager, but the pricing of the subscription and the fact that it was an Electron app killed it for me. Currently test-driving a smaller alternative with a one-time payment.

ElijahLynn 4y ago

One problem with that is if a person has a non-Apple product, Apple won't build the app cross-platform, so they are even further locked into Apple hardware then. Might not affect that many people. But it would surely limit choice for those who don't even know about the lock-in later in their lives.

m000 4y ago
Any attempted lock-in is guaranteed to attract attention of EU regulators. This is what Apple probably wants to avoid. They won't be allowed to play a "Safari" this time (i.e. all password managers are allowed, as long as they are a frontend to our own password manager). Also, having the password manager as a separate app, it is likely they will be asked to provide a standalone password migration API for third party password managers. This would make switching to another ecosystem trivial for moms & pops, who currently need to deal with CSV import & export* if they want to move their passwords out of iCloud. * Not sure what the situation is ATM, but a few years back exporting passwords from iCloud was not directly supported. I had to run a third-party AppleScript script to generate a CSV to import in another password manager.

Anechoic 4y ago

Keep a “Notes” field where you can add extra data, like 2FA backup codes, for each password! I'm not sure if the reference here is to Keychain's "Secure Notes" or the "comments" field associated with password items. If the latter, I've found (at least on older versions of OS X/macOS) that when Safari updates the value of a changed password, it deletes the comments! I used the comment field to add the (random) answers to security questions, and got burned on a couple of sites when I've needed to do an account reset and lost those answers.

shagie 4y ago
> that when Safari updates the value of a changed password, it deletes the comments! It doesn't change a password, it creates a new one. This means if you somehow mangle saving the password (you thought you updated it, but didn't) the older password is still in your keychain with the older note and it can still be retrieved.

w-m 4y ago

Tangentially related, something that has slightly inconvenienced me a few times: Can someone point me to a setting to get Siri to show me my passwords again, on iOS 16? Before, I could ask on an unlocked phone to “show me my password for GitHub” and Siri would open the settings app with the password list and show the GH credentials. Now (since iOS 16?) Siri just refuses to do any request that contains ‘password’.

selykg 4y ago
You mean Shortcuts? You can have it open this URL: prefs:root=PASSWORDS You'll want to set up Siri separately as part of it, but you can definitely do that with Shortcuts.
- w-m 4y ago
  Interesting, thanks! What I described didn’t need a shortcut before. It was a vanilla iOS feature. I assume it went away for privacy reasons with one of the OS updates. And hoped there’d be a setting to get it back.

DantesKite 4y ago

I get the impression Apple doesn't want a dedicated app for passwords because they don't want people to think about passwords. It shouldn't be something people manage, hassle, or worry over. They likely want people to just be able to open their phones and have it uniquely identify them seamlessly across a variety of sites. Unfortunately, they're not quite there yet.

ElijahLynn 4y ago
Good point, the end goal is probably some sort of biometric MFA solution.
CharlesW 4y ago
> I get the impression Apple doesn't want a dedicated app for passwords because they don't want people to think about passwords. I think you're right. Ventura's Passwords Settings shows that they're in transition away from the archaic Keychain app to something. My guess is that they're skating to where the puck will be in 2025 when Passkeys are universally supported, and for most use cases auth will be automatic.

rohan_ 4y ago

>(And it all syncs across your devices, for free?!) IMO the worst part about apple keychain is they can't be used with Chrome (the most common browser for mac!)

sargun 4y ago
I believe this is as much on the Chrome side as it is on the Apple side: https://bugs.chromium.org/p/chromium/issues/detail?id=312105 https://bugs.chromium.org/p/chromium/issues/detail?id=312105 Chrome could access those natively on Mac, or use the keychain as the native backing store, from what I can tell.
apike 4y ago
I too find this frustrating, but I’m curious about the claim that Chrome is the most common browser on Mac. I sometimes see this claim, but I struggle to find any data to back it up. The US government web analytics (https://analytics.usa.gov/data/ https://analytics.usa.gov/data/), which seems like a reasonable source for general usage in the US, show Safari substantially ahead of Chrome on Mac. Have you seen any sources that show Chrome ahead of Safari on Mac for a general audience?
fckgw 4y ago
You can, Apple has an extension for iCloud Keychain. https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en https://chrome.google.com/webstore/detail/icloud-passwords/p...
- snowwrestler 4y ago
  > iCloud Passwords is a Chrome extension for Windows users…
- rohan_ 4y ago
  Windows only

defulmere 4y ago

Every time I see a question like "Why doesn't Apple build $THIS?" I assume the answer is "because they'll make more money selling 3rd-party $THIS in the app store".

culturestate 4y ago
> I assume the answer is "because they'll make more money selling 3rd-party $THIS in the app store" Apple has a long and storied history of doing almost exactly the opposite - any sufficiently popular third-party utility either gets bought and integrated (eg Workflow, Dark Sky) or Sherlocked (eg f.lux, Watson). Apple takes a very long-term view of revenue generation, and the App Store commissions from $random_app are way less valuable to Apple than the LTV of a customer who’s locked into buying Macs and iPads because of Apple’s proprietary version of $random_app.

richardw 4y ago

You should see the horror that is changing your country and phone number. I spent weeks hunting around the phone to stop weird things from happening. You would think Apple were smart enough to say “it looks like you’ve changed details. Can I update the plethora of places I use your number?”

imchillyb 4y ago

Until Apple’s keychain works reliably across all platforms, I’ll continue to use Dashlane Password manager.

AdamGibbins 4y ago

Edit: Removed initial comment, confused my iOS faults. Keychain its current configuration is risky, given its coupled to your iPhone password which many people frequently enter in a public setting. One shoulder surf followed by a phone theft and they've unlocked everything - including your iCloud account (which you can change the password on using iPhone password only).

buildbot 4y ago
It needs biometrics or passcode to unlock?
Jaxan 4y ago
> you can access it when your phone is unlocked without any additional authentication. No you can not. On my iPhone I have to authenticate with my finger print or pin code again for the passwords.
azinman2 4y ago
If I go to system settings > password on iOS, it then requires Face ID to get in. So I’m not sure what you’re talking about. Under Face ID & passcode you can also require Face ID for a password auto fill. So I don’t think any of this is correct.
- sabin1001 4y ago
  [dead]
simonklitj 4y ago
Are you sure? I always have to scan Face ID, whether it's to open the "Passwords"-section in Settings or to have it automatically paste a password on a website/app. How do I access these things without additional authentication?

twobitshifter 4y ago

Anyone know how to use Microsoft otp with another app?

sabin1001 4y ago

[dead]

izolate 4y ago

I switched to Apple's password manager after being burned by Twilio Authy's inability to retrieve the 2FA setup codes. I wish they had made this lock-in more clear. Overall I'm happy with my decision. I'm now even using Safari over Chrome full-time because it has the benefits 2FA autofill. Only thing missing is a dedicated app, but I have Apple Shortcut that works well enough in the meantime.

monocularvision 4y ago

Am I the only person on Earth that needs sharing of passwords among my family? Any time folks bring up password solutions, they are always missing this requirement for me. 1Password is a life-saver in this regards. All my kids have their own vaults but for the little ones I have them use a shared vault between my wife and me so we have access to their passwords. I can also easily share passwords for services like Netflix so the kids don’t have to bug me. It has been great for teaching kids about password hygiene (what makes for a good password) and management (don’t reuse passwords!). And it being cross-platform is great for my older kids with gaming PCs.

e40 4y ago
1Password with son, wife, father and mother... life saver.
ellisv 4y ago
I agree that is one of the big issues with keychain. You can share keychain items with people but it is awkward.
- jtbayly 4y ago
  Are you referring to Airdrop password and passkey sharing?[1] That’s the only way I can find other than manual copy/paste. Also, I very much doubt if I later change the password I shared via Airdrop that it will update on the other person’s device… which is half the point. [1]: https://support.apple.com/guide/iphone/share-passkeys-passwords-securely-airdrop-iph0dd1796bb/ios https://support.apple.com/guide/iphone/share-passkeys-passwo...
  - ngai_aku 4y ago
    Yeah, that’s how I share with my wife. I don’t anticipate that it would stay in sync if I updated it, but I can’t say that I’ve tried. Do you regularly rotate passwords?
    - jtbayly 4y ago

cmnt 4y ago

It's incredible how Apple make it's users happy to lock-in in their eco-system. I don't really know Apple eco-system but it seems weird to migrate from tierce app (already well integrated) like Bitwarden to keychain. I've lost count of the people who have switched from their Music App to Apple Music for no reason other than "it's Apple". Apple make good hardware and their eco-system seem amazing too, but people should see the advantages to be not entirely depedent from a company.

deergomoo 4y ago
> but people should see the advantages to be not entirely depedent from a company I think you're overestimating how much the average person thinks or cares about their computing platforms. They want something that works and gets out of the way, and to that end having everything come from one company is a feature, not a bug. I mean I consider myself a power user and I still use iCloud Keychain purely because I was already using Safari when it launched, so it already had all my passwords. I recognise the advantages of third-party offerings, but to me they're not enough to bother moving all my stuff over. Similarly I still use a third-party 2FA app because I was using it before Apple added it into iCloud Keychain (and also because the third-party app has an Apple Watch app and I've grown accustomed to reading the codes off my wrist).

stalfosknight 4y ago

That app is called Keychain Access on macOS.

geuis 4y ago

I really want to use Keychain for all of my password management. But nothing works. Like I'm in serious need of a highly secure cross browser/cross platform password solution. On my phone, everything is fine. But I use Chrome on MacOS and my Windows desktop. Chrome used to use Keychain on MacOS, but some years back Google changed the product to tie into their own user accounts. I refuse to sign into a browser itself just to use the web. The iCloud password extension for Windows (chrome/edge) absolutely DOES NOT WORK. I have tried getting it to work for the better part of a year. Finally gave up and removed the useless thing. I probably dumbly still trust Apple's security policies and would prefer to use Keychain as my fits-all-sizes security tool, but the combo of product incompatibilities and non-working Apple authored software makes it impossible.

immdischt 4y ago

The article is informative but failed to describe where to find Apples password settings / feature while complaining about how hard is is to find…

thiht 4y ago

I'd never use a password manager built by Apple for the same reason I don't use Chrome's password manager or Firefox's password manager. All these passwords managers have strong incentives for "working best on <platform>™". I want a password manager independent from any platform like Bitwarden or 1Password, because it's actually valuable for THEM to target all the platforms they can.

sowbug 4y ago
I don't understand. Chrome and Firefox don't have platforms. Which means they run pretty much everywhere they're allowed to. Apple is the only one of those three that restricts their software to hardware that only they sell. So in that case I do understand your position.
- HeavyFeather 4y ago
  > they run pretty much everywhere they're allowed to. Yep, they’re allowed to run on Chrome, that’s Google’s platform. Good luck using your Chrome/Google passwords outside Chrome/Google apps. Firefox at least does (or used to) offer a Lockbox app to use the password on your phone.
- thiht 4y ago
  A browser is a platform. I have no easy way to use passwords saved in Chrome in Safari for example. It matters to me because I use Firefox and Chrome on my work desktop, Safari and Firefox on my personal desktop, and Safari on my phone. And I want the ability to switch browser easily. Same goes for Apple passwords, I still use Windows for some games, and I want to access my passwords easily.
HeavyFeather 4y ago
The problem is that the integrated managers really do work best on platform, i.e. alternatives aren’t nearly as well-integrated. So here I am using Safari on my computer and phone.
deleted 4y ago
[deleted]

tacker2000 4y ago

The worst thing is when I register a new password to a website on my Mac on Firefox and then want to login to the site on my iPhone. I literally have to type the (complicated) password again so that it gets saved in Keychain. Why wont Keychain allow Firefox sync? This seems like an extremely common use case.

pantojax45 4y ago

I wish you could add a second password or different passcode on top of iCloud Keychain / apple passwords. I get nervous at how easy it is to compromise all passwords: 1. Give someone your phone passcode, they can change apple account password. P0wned 2. Have iCloud Keychain on laptop… other user account resets password on account. (Or use it on work computer without realizing) 3.

nytesky 4y ago
Turn on screentime and prevent account changes with a 2nd PIN Might also limit password changes but unsure.

aquanext 4y ago

My best guess is that Apple won't do it because their plan is to phase out passwords entirely. That's what that whole FIDO Alliance (https://fidoalliance.org https://fidoalliance.org) is all about. And 1Password is part of that too: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all... I think that ultimately a password tool needs to be available on multiple platforms, like 1Password. Having it just be on Apple stuff just isn't gonna work for the many Windows and Linux machines I begrudgingly have to interact with.

ttul 4y ago
1Password knows that it will take centuries for passwords to disappear even if a password-less future is already here.
- Hamuko 4y ago
  Passwordless future definitely wasn't here just 1-2 years ago. The management of WebAuthn Discoverable Credentials / Resident Keys was so fucking awful on every platform I tested them on. You want to clear your Resident Key for a website on Windows? Command-line.
- judge2020 4y ago
  1Password has embraced it: https://blog.1password.com/passkeys-are-coming-to-1password/ https://blog.1password.com/passkeys-are-coming-to-1password/ While I'm not sure how they've integrated it so far, I imagine browsers will either implement a plugin API for extensions to handle passkeys, or 1p can override the webauthn api and fallback to the browser when a website is authenticating.

kup0 4y ago

Not sure we want to ask Apple to build more software when they can't even get the quality of their existing software up to par. I would be strongly inclined to stick with something less tied to the platform/ecosystem, like 1Password

404mm 4y ago

One core feature that will keep lot of people from using Apple Password manager is family setup. Anyone with Apple family knows how bad it can be when you have dozens or hundreds of shared passwords between you, your spouse and / or kids.

rootusrootus 4y ago
Yep. 1Password has my business indefinitely because of this requirement. Apple may be building a nice solution for single people (and perhaps many non-parents), but it's useless for family use.

pharos92 4y ago

100% - the current method of access (via settings) is so nu-intuitve. A real sign of the state of Apple over the last few years. Customer UX needs to become front-and-centre again.

sholladay 4y ago

I don’t personally care much whether Passwords is in Settings or a separate app. But I do have one problem with it. As far as I can tell, you must save a password for a site in order to use the TOTP 2FA feature. I don’t want my device filling in passwords for me because it defeats the purpose of a password being “something I know”. The 2FA code is more like “something I have” and I’m okay with the device filling that in, but not the password. There doesn’t currently seem to be a way to set up only the 2FA code for a site.

shortcake27 4y ago
The “something you know” is your devices pincode/passcode/iCloud password, not the password to the website. If you know the password to a website it means you’re reusing passwords or using a pattern to generate passwords, both of which are less secure than randomly generated passwords (especially the former). Of course, nothing is stopping you from saving a bogus password either.
- sholladay 4y ago
  I don’t buy it. Complex, random passwords are great against brute force attacks but that’s not usually how these things play out. Many password breaches are caused by technical lapses on the part of a platform, where password complexity often becomes irrelevant. Your password gets hovered up along with everyone else’s and eventually gets decrypted, and tried en masse against other platforms. In this scenario, even a simple pattern for passwords is probably enough to prevent the problem from spreading, as long as it’s not too obvious. The other way passwords often get compromised is from someone looking over your shoulder or key logging, infrared on PIN pads, etc. In this scenario, your system is WAY, WAY worse, since one password unlocks the kingdom, and that password is frequently being used. As it stands, if someone peeks over my shoulder and discovers my phone password, then steals my phone, it’s damaging but not game over. They can’t access any websites. If I allow my phone password to be the only gatekeeper to access everything, IMO that’s lousy security.

cglong 4y ago

I appreciate Apple adding the ability to export your passwords, but it's ridiculous it took until 2021 for this to happen.

alana314 4y ago

They don't make it clear on iOS which password manager you're using, which hurts both them and other password managers I think. The worst experience is not knowing where your password is or which account it's using. I had to turn off all apple password management in preferences, I've thought about going all-in on apple passwords but don't think it has all the features I want.

sacnoradhq 4y ago

This is unnecessary because it's a problem that's already solved. - BitWarden - for personal use, stores 2FAs and acts as an iOS password source. (The claimed attacks were mitigated) - Keeper - for enterprise use, stores 2FAs and acts as an iOS password source - Duo - for 2FA for enterprise use with backup text mechanisms. Edit: Duo's primary app mechanism is similar to Google Gmail app's mechanism of a yes/no popup to approve a 2FA request ^ The above are cross-platform and extend beyond Apple.

hot_gril 4y ago

I've been using Keychain since 2003. Only now am I aware that it does TOTP. I've been avoiding TOTP like the plague this whole time because I don't trust the other apps not to somehow get me locked out.

hot_gril 4y ago
(Especially Google Authenticator, especially the original version where they said it's WAI that you can't transfer codes across phones. Keep that nerd stuff away from me.)

r0m4n0 4y ago

I think a few problems imho: 1)they don’t do cross platform software well so they would never make a windows app, chrome extension, android integration etc. It’s either all or nothing which I would never buy into (even as an iPhone and mbp user) 2) there are actually a ton of use cases here that make the software actually very complex and high stakes. I’d wager the pros don’t outweigh the cons. Also apple isn’t known for complex software with niche use cases. Honestly their current safari/iphone password manager is trash They do a few things well and rely on lock-in and ecosystem

mperham 4y ago

It seems apparent that Apple are investing in Passkeys as the future and passwords are legacy infrastructure in a sense. https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...

thom 4y ago

Gimme something to make family passwords easy (eliminate passwords!) Enable Apple ID logins for kids. Throw your weight around to move safety settings into some sort of open web standard. I’ve got 1Password but the daily pain of managing a family of users with various accounts is just too much right now and I would pay almost any amount of money to have a simple solution that I never had to think about.

noizejoy 4y ago
Have you seen this? https://arstechnica.com/information-technology/2022/10/passkeys-microsoft-apple-and-googles-password-killer-are-finally-here/ https://arstechnica.com/information-technology/2022/10/passk...

gumby 4y ago

The nice thing is: the way they implemented this it looks like you could pretty easily write a 1passwordish mac client as an interface to the system infrastructure. I say "1passwordish" because one of the tedious part of a program like that is the browser parsing to handle all the weird authentication cases devs write. Unfortunately I'm not an ios dev and wonder if it might even be possible to do the same on ios? I believe there is an API so you can write a password manager (1password et al use that) but can you get to the secure system services? Edit: I now see who wrote this blog post. Were it straightforward on ios he probably would have said so.

frutiger 4y ago
I am not an expert macOS/iOS developer but I unsuccessfully played around with the API a couple of times. You can’t access passwords stored by another app (app identifiers appeared to be globally unique, e.g. com.apple.Safari). There was an additional hurdle to access/store items in the iCloud keychain, though I forget what exactly. This restriction makes sense.

muhammadusman 4y ago

I resisted using 1Password for a long time but then once I got into the 1P world, it was better than all the alternatives. LastPass is unsafe, Dashlane has subpar experience, and all the proprietary ones are missing tons of features. Chrome, Firefox, Apple, I'm sure Windows too, have all their own password managers and all of them are hard to use and expect you to only have devices in their ecosystem. 1Password is worth every penny for how well they've kept up with updating their apps and their prevalence on all platforms. And the 2FA integration is great too!

vbezhenar 4y ago

I tried to use Apple passwords. 1. It really hates storing anything but website passwords. I have servers with ssh login/passwords. I have bank cards with cvv and pins. I have phones with pins. WiFi passwords. And other things not fitting to website/username/password. 2. Not enough fields. I'm ascetic when it comes to storing passwords, but it doesn't even have "notes" field. So experience is subpar. It's possible to emulate some things, but in the end I decided to go with StrongBox. It's not ideal, I don't like UI, but it has all the functions I need. I also like KeePassium, but it's missing sync and mac app. I know that Apple KeyChain has secure notes, but those are not accessible on iPhone, AFAIK.

kstrauser 4y ago
It does have a notes field now. I’m not sure when that was added.

permo-w 4y ago

my issue with apple passwords is that you literally cannot put a password on them. iPhone forces you to use biometrics as your key for them. whatever you think about passwords vs biometrics, the fact that I literally cannot choose is ridiculous and a massive oversight

r00fus 4y ago
Biometrics or your device passcode. My mom has a touchid phone (won't get the faceid due to paranoia) and she gives up on it during winter when her fingers get cracked due to the heating. So when she logs into the device it always falls back to device passcode. I am frustrated they won't allow you to do both bio+code, because that would prevent my kids from flashing my pilfered phone in my face to get it to unlock then running away.

mzmzmzm 4y ago

Tangential but I hate that Mozilla abandoned their password manager app that uses the sync service they still maintain, instead of adding a TOTP/OATH feature and giving people a better and more open option than Duo and skeezy password managers.

cush 4y ago

One word. Liability

theden 4y ago

I recommend https://strongboxsafe.com/ https://strongboxsafe.com/ as a better open source alternative Works with touchID on my MacBook, uses KeePass so it's easy to migrate if needed, and the killer feature for me was being able to sync it to iCloud so you can use it across devices. Even better if you enable E2E encryption on your iCloud https://support.apple.com/en-au/HT212520 https://support.apple.com/en-au/HT212520

faeriechangling 4y ago
It's a good piece of software for what it is, but the tool is .kbdx based and like all such solutions tends to handle shared secrets rather poorly. It also handles adding new secrets for new accounts less elegantly than Apple's own built-in password manager which has a nice flow for adding anonymous forwarding email addresses and contact details for new accounts so long as you commit to the cult of iCloud. Still if you need a multi-platform password manager that performs well on Apple devices there's nothing I can recommend since you can just use .kdbx tools on other platforms and strongbox itself has highly reliable multi-cloud sync, extremely fast input of secrets, a better security model than keychain itself has, and even has MacOS Chrome support (abliet hacky support) if you feel like trusting the plugin. It makes Bitwarden and other Keepass clients feel clunky in comparison.

rtpg 4y ago

I think icloud is pretty decent as a solution, but one thing I think is kind of worrying is that it unlocks with the same "key" as your phone. So if someone sees your PIN code, they can not only unlock your phone, they can get all of your passwords and change those passwords very quickly. I enjoy 1Password being separate in that regard, and I would really like it if the iOS keychain would let you set a separate password in that respect.

chrisfinazzo 4y ago

I might argue instead that simply having Passwords as another item inside Settings is appropriate for what functionality it exposes. It's a feature, not a product, doesn't do everything that Keychain Access does in macOS, and doesn't need (or deserve) to be in your face all the time. Do keyboards/wallpaper/voip apps/whatever really need to have their own app icon on your homescreen? Probably not, but Apple's conditioned us over the course of 15 years that all apps have icons you can see - a view at odds with things like Fantastical and SwitchGlass, which are really "apps that run in your menubar" and can be used without a Dock icon at all. iOS doesn't have the concept of "Utilities" within "/Applications" like macOS does, but maybe it needs to in order to address this class of app which has such a specific focus. After 15 years, are we at a point where some of the early affordances aren't neccessary anymore?

HeavyFeather 4y ago
Do you really need to go back to your car, open your trunk, get the wallet just to show your ID? Passwords are my ID, sometimes I have to enter them onto another computer or app or just share them with someone; I shouldn’t need to hunt my ID in the trunk of my car. Keychain Access did this right decades ago, so there’s some logic behind it. The issue is that the app is not built for this decade and its UI is lacking.

pyuser583 4y ago

Lots of apple “settings” deserve an app.

tap-snap-or-nap 4y ago

At this point, the whole password based infrastructure needs a revamp.

willhackett 4y ago

I'm all for this, a better cross-platform Keychain app would be awesome. To get my Credit Card details, I need to go Settings > Safari > AutoFill > Saved Credit Cards. To get 2FA / Password details, I need to go Settings > Passwords. In a lot of cases, they auto-fill without issue. But to manage these is a bit of a flimsy process.

imWildCat 4y ago

Don't put all your eggs in one basket. Don't put all your passwords into one single software provider.

dbg31415 4y ago

Apple would put 0 effort into making the app work across platforms and browsers and devices. They're not a good fit for this space.

bert2002 4y ago

The goal is to go passwordless.

AnonC 4y ago

Perhaps this is one of the “user requested features” Apple is going to implement in iOS 17 and its cousins? As per a recent and vague rumor, Apple is going to add more user requested features and is adding them late in the development cycle. [1] It would be great to have a nice UI for managing passwords, 2FA codes, etc. Add password sharing over iCloud and it could be a game changer! [1]: https://www.macrumors.com/2023/03/26/ios-17-to-provide-several-most-requested-features/ https://www.macrumors.com/2023/03/26/ios-17-to-provide-sever...

altitudinous 4y ago

I agree (and its not often I agree with folk on Hacker News), Apple provide a far superior password service inside a far inferior UI. The handling of authentication codes is particularly great in the Apple ecosystem, but very poorly promoted. For a company that markets itself as secure these are retrograde steps.

crossroadsguy 4y ago

Apple needs to fix iCloud (or anything where a sync/etc is required) to something that’s at least reliable and transparent from the 2023 standards! Period. As of now it’s so poor if not downright broken. Because without that everything on the software side by Apple will just remain glorified things that the fans keep bleating about - “just works”, “is perfect”, “just what I need”. For heaven’s sake Apple does a shoddy job of syncing et cetera and obscures it from the user in the guise of usability and that “Apple knows what users need to do”, not what they want.

Bondi_Blue 4y ago

You can always make a Shortcut to open the Passwords section of System Settings. And put that in your dock or wherever.

kjto 4y ago

what about https://authy.com/download https://authy.com/download? mobile/desktop/cloud sync, free...

hollowturtle 4y ago

I did a new mac setup recently and just discovered, after many years of use, that I cannot use 1 Password 7 anymore :( The app works it’s just they’re phasing out the browser “classic” extension with the excuse(?) it won’t work with the new manifest v3, so a migration to 1 password 8 is required. I hate their subscription model and I think I’ll self host bitwarden, but was also considering the system password manager, or the one builtin into Firefox. Problem is passwords won’t leave the browser ecosystem in this way and it’s more often than not that today you need to move password cross platform and cross device. So I don’t see an apple password manager as the best solution, they usually stay inside their walled garden

Jolter 4y ago
For your preferences, I’d propose Keepass. Maybe you’ve already looked into it.

yomyogd 4y ago

There's bitwarden that does it all, cross-platform and completely free.

markkvdb 4y ago

The password managers ("Passwords" and "Keychain Access") seem deliberately limited. A few issues that I noticed: The discrepancy between the "Passwords" and "Keychain Access" app. Passwords manages 2FA codes whereas Keychain doesn't. Keychain allows you to add another URL for a password whereas Passwords doesn't. The latter issue often leads to headaches dealing with passwords when the URL of the login page is not the same as the URL for the second part of the 2FA. An example that became unnecessarily frustrating. Heroku makes you login to dashboard.heroku.com but the 2FA code needs to be filled in at a salesforce URL. Since I can't add this salesforce URL to the existing password (+ 2FA code) I have to manually copy the code. The shortest routine I found for that is: 1. CMD+Space. 2. Enter "passw". 3. Click on the search bar. 4. Enter "Heroku". 5. Click on the password. 6. Go back to the web page to enter the displayed code. Simply having the option to add another URL (which was possible in Keychain Access) would solve this entire issue...