6 ms·

I have been using the Apple manager since LastPass got hacked recently. Hot take , but … I like the lack of integration in other operating systems/ browsers.

I have been using the Apple manager since LastPass got hacked recently. Hot take , but … I like the lack of integration in other operating systems/ browsers. I see my phone as a Secure Enclave, and my passwords should be disconnected from potentially insecure systems. I see the phone as those keychain one time passwords where you have to press a physical button to get a key. Is it inconvenient to get a password, yes. But it offers the piece of mind that I only have to worry about iPhone/Apple exploits, instead of chrome+firefox+windows+Linux+Apple+iphone. I don’t think in this case Apple is not doing the integration because of this security feature, but I think it is a feature non the less. Of course you can always choose not to install the extensions even if they existed, but the point is that if they existed it would lower security.

imwithstoopid 4y ago
don't lose or break your phone....
- MBCook 4y ago
  iCloud solves that.
  - whitewingjek 4y ago
    Unless Apple ever starts following Google's lead to ban accounts for any infraction and you don't store backups... Not saying Apple is doing that now, but I imagine it's not outside the realm of possibility.
    - great_psy 4y ago
      We can use the same argument for any other cloud password manager. If google/Apple blocks my access, well it’s those services I am trying to log into in the first place so the point is moot. Also I have recovery keys for the more important accounts printed and stored in a safe box.
      - rpgbr 4y ago
        Except password managers that YOU need to take care your vault, like KeePassXC.
        great_psy 4y ago
        I used keePass before LastPass, but the issue was with keeping the file synced. I had it in Dropbox and I was able to open it no problem from the phone, but making updates from phone was a challenge. Maybe I was not using a good app but it was a hassle to keep it synchronized. But anyway, somebody could cut off your access to Dropbox, but it’s less of an issues since you have a backup.
        rpgbr 4y ago
        I simply don’t sync my vault. I don’t add or change passwords very often, so I treat the vault in my computer as a “main copy” and once a week, during my backup routine, I copy the current vault to my phone. Never had an issue.
      - whitewingjek 4y ago
        I agree, perhaps I should have emphasized that my point of view is that anyone should back up anything stored on the cloud. Which I'm glad to know you can at least do with Keychain [1], although I use Bitwarden myself. [1] https://support.apple.com/guide/keychain-access/import-and-export-keychain-items-kyca35961/mac https://support.apple.com/guide/keychain-access/import-and-e...
  - ex3ndr 4y ago
    Not really, you need another device to share icloud keychain
    - MBCook 4y ago
      Nope. Buy a new iPhone, sign in, it’s all back. It’s useful even in non-multi-device scenarios.
      - ex3ndr 4y ago
        So, it is not encrypted? nice
- great_psy 4y ago
  I have my old iPhone with no sim that I mostly take to the gym to protect the new one.
  - efdee 4y ago
    How do you access your passwords on your new iPhone from your old iPhone? Oh, they're stored online? There goes your entire "secure enclave" argument ;-)
  - InCityDreams 4y ago
    >I have my old iPhone with no sim that I mostly take to the gym to protect the new one. What is the other one doing in the gym, unprotected?
    - great_psy 4y ago
      One at home, one with me for Spotify in my pocket.
rpgbr 4y ago
This was precisely what drove me off Apple password manager. If your iPhone were compromised, such as in those iPhone unlocking scams[1] (something quite common here in Brazil at least since 2021), it's game over for your entire password database. I've been using KeePass apps (MacPass on macOS, KeePassium no iOS), with a different, unique master password, unlogged by default on iPhone, plus DB locks automatically after 10 minutes of inactivity. Maybe I'm way off, but it seems safer to me. [1] https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas...
- lxgr 4y ago
  Absolutely. Given these reports, Apple's security model isn't close to being sophisticated enough to warrant trusting them with passwords or (even more critically, arguably) WebAuthN passkeys. I recently saw it with my own eyes as a family member was able to reset their iCloud password and gain full access to their account on a new device, including iCloud Keychain, using nothing but their iPad and the corresponding unlocking code. No iCloud password, no SMS-2FA (not that it would help much in the case of a stolen iPhone), nothing else.
  - great_psy 4y ago
    Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
    - lxgr 4y ago
      The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device. They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys. I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.
makeitdouble 4y ago
Thing is, even within these constraints it has rough edges. If you have two accounts (let's say a personal one and work/family/org one), getting passwords for the second account will just be a PITA. Same issue of course if you need someone else's password (e.g. your spouse's hotel reservation account's password) Trying to work this around means you'll either be asking people's passwords other the phone or other means, or you'll often switch between accounts and will want lower security on the account themselves as the identification process get old very quick. Basically, these limitations are not without impact on security and how people will deal with them.

imwithstoopid 4y ago

don't lose or break your phone....

MBCook 4y ago
iCloud solves that.
- whitewingjek 4y ago
  Unless Apple ever starts following Google's lead to ban accounts for any infraction and you don't store backups... Not saying Apple is doing that now, but I imagine it's not outside the realm of possibility.
  - great_psy 4y ago
    We can use the same argument for any other cloud password manager. If google/Apple blocks my access, well it’s those services I am trying to log into in the first place so the point is moot. Also I have recovery keys for the more important accounts printed and stored in a safe box.
    - rpgbr 4y ago
      Except password managers that YOU need to take care your vault, like KeePassXC.
      - great_psy 4y ago
        I used keePass before LastPass, but the issue was with keeping the file synced. I had it in Dropbox and I was able to open it no problem from the phone, but making updates from phone was a challenge. Maybe I was not using a good app but it was a hassle to keep it synchronized. But anyway, somebody could cut off your access to Dropbox, but it’s less of an issues since you have a backup.
        rpgbr 4y ago
        I simply don’t sync my vault. I don’t add or change passwords very often, so I treat the vault in my computer as a “main copy” and once a week, during my backup routine, I copy the current vault to my phone. Never had an issue.
    - whitewingjek 4y ago
      I agree, perhaps I should have emphasized that my point of view is that anyone should back up anything stored on the cloud. Which I'm glad to know you can at least do with Keychain [1], although I use Bitwarden myself. [1] https://support.apple.com/guide/keychain-access/import-and-export-keychain-items-kyca35961/mac https://support.apple.com/guide/keychain-access/import-and-e...
- ex3ndr 4y ago
  Not really, you need another device to share icloud keychain
  - MBCook 4y ago
    Nope. Buy a new iPhone, sign in, it’s all back. It’s useful even in non-multi-device scenarios.
    - ex3ndr 4y ago
      So, it is not encrypted? nice
great_psy 4y ago
I have my old iPhone with no sim that I mostly take to the gym to protect the new one.
- efdee 4y ago
  How do you access your passwords on your new iPhone from your old iPhone? Oh, they're stored online? There goes your entire "secure enclave" argument ;-)
- InCityDreams 4y ago
  >I have my old iPhone with no sim that I mostly take to the gym to protect the new one. What is the other one doing in the gym, unprotected?
  - great_psy 4y ago
    One at home, one with me for Spotify in my pocket.

rpgbr 4y ago

This was precisely what drove me off Apple password manager. If your iPhone were compromised, such as in those iPhone unlocking scams[1] (something quite common here in Brazil at least since 2021), it's game over for your entire password database. I've been using KeePass apps (MacPass on macOS, KeePassium no iOS), with a different, unique master password, unlogged by default on iPhone, plus DB locks automatically after 10 minutes of inactivity. Maybe I'm way off, but it seems safer to me. [1] https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas...

lxgr 4y ago
Absolutely. Given these reports, Apple's security model isn't close to being sophisticated enough to warrant trusting them with passwords or (even more critically, arguably) WebAuthN passkeys. I recently saw it with my own eyes as a family member was able to reset their iCloud password and gain full access to their account on a new device, including iCloud Keychain, using nothing but their iPad and the corresponding unlocking code. No iCloud password, no SMS-2FA (not that it would help much in the case of a stolen iPhone), nothing else.
- great_psy 4y ago
  Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
  - lxgr 4y ago
    The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device. They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys. I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.

makeitdouble 4y ago

Thing is, even within these constraints it has rough edges. If you have two accounts (let's say a personal one and work/family/org one), getting passwords for the second account will just be a PITA. Same issue of course if you need someone else's password (e.g. your spouse's hotel reservation account's password) Trying to work this around means you'll either be asking people's passwords other the phone or other means, or you'll often switch between accounts and will want lower security on the account themselves as the identification process get old very quick. Basically, these limitations are not without impact on security and how people will deal with them.