3 ms·

I don’t personally care much whether Passwords is in Settings or a separate app. But I do have one problem with it. As far as I can tell, you must save a passwo

I don’t personally care much whether Passwords is in Settings or a separate app. But I do have one problem with it. As far as I can tell, you must save a password for a site in order to use the TOTP 2FA feature. I don’t want my device filling in passwords for me because it defeats the purpose of a password being “something I know”. The 2FA code is more like “something I have” and I’m okay with the device filling that in, but not the password. There doesn’t currently seem to be a way to set up only the 2FA code for a site.

shortcake27 4y ago
The “something you know” is your devices pincode/passcode/iCloud password, not the password to the website. If you know the password to a website it means you’re reusing passwords or using a pattern to generate passwords, both of which are less secure than randomly generated passwords (especially the former). Of course, nothing is stopping you from saving a bogus password either.
- sholladay 4y ago
  I don’t buy it. Complex, random passwords are great against brute force attacks but that’s not usually how these things play out. Many password breaches are caused by technical lapses on the part of a platform, where password complexity often becomes irrelevant. Your password gets hovered up along with everyone else’s and eventually gets decrypted, and tried en masse against other platforms. In this scenario, even a simple pattern for passwords is probably enough to prevent the problem from spreading, as long as it’s not too obvious. The other way passwords often get compromised is from someone looking over your shoulder or key logging, infrared on PIN pads, etc. In this scenario, your system is WAY, WAY worse, since one password unlocks the kingdom, and that password is frequently being used. As it stands, if someone peeks over my shoulder and discovers my phone password, then steals my phone, it’s damaging but not game over. They can’t access any websites. If I allow my phone password to be the only gatekeeper to access everything, IMO that’s lousy security.

shortcake27 4y ago

The “something you know” is your devices pincode/passcode/iCloud password, not the password to the website. If you know the password to a website it means you’re reusing passwords or using a pattern to generate passwords, both of which are less secure than randomly generated passwords (especially the former). Of course, nothing is stopping you from saving a bogus password either.

sholladay 4y ago
I don’t buy it. Complex, random passwords are great against brute force attacks but that’s not usually how these things play out. Many password breaches are caused by technical lapses on the part of a platform, where password complexity often becomes irrelevant. Your password gets hovered up along with everyone else’s and eventually gets decrypted, and tried en masse against other platforms. In this scenario, even a simple pattern for passwords is probably enough to prevent the problem from spreading, as long as it’s not too obvious. The other way passwords often get compromised is from someone looking over your shoulder or key logging, infrared on PIN pads, etc. In this scenario, your system is WAY, WAY worse, since one password unlocks the kingdom, and that password is frequently being used. As it stands, if someone peeks over my shoulder and discovers my phone password, then steals my phone, it’s damaging but not game over. They can’t access any websites. If I allow my phone password to be the only gatekeeper to access everything, IMO that’s lousy security.