3 ms·

> why don't I just "go with the flow", adopt iCloud Keychain and passkeys? I don't like the "on principle" response since a lot of people will end up thinking,

by II2II 2y ago

> why don't I just "go with the flow", adopt iCloud Keychain and passkeys? I don't like the "on principle" response since a lot of people will end up thinking, "oh, so it doesn't really matter." Even the author's elaboration could lead to responses like: "they are control freaks," or "they are paranoid." In my case, the answer is simple: I have access to systems that contain confidential information about other people. Protecting their data is my responsibility. While I have little doubt that Apple (and other vendors that provide similar services) do their best to guarantee the security of these products, their centralized nature and potential value of the data it leads to make them very juicy targets.

andrewaylett 2y ago
I suspect that Apple (and Google) are going to be better at maintaining my privacy (at least from anyone who isn't Apple (or Google, respectively)) than I am. For the record, there's plenty of data I wouldn't want to give either company (especially Google) but the answer there is also fairly straightforward: I don't put my passwords into my iCloud Keychain. Or, for that matter, into Google's password manager.
- dijit 2y ago
  I am your government. I am your doctor. I am your lawyer. I don't trust any company, let alone a foreign controlled one to have authorised access to my accounts as me. I would be held accountable if they were exposed and they sufficiently covered their tracks (and they are incentivised to try). Why should I brazenly permit this? (for the record, as a private individual I am using iCloud keychain, and for work I use 1password with its online storage: however I just make video games, I don’t have the power to destroy lives, nor do I have a responsibility to avoid it; I am merely pointing out that perfect being the enemy of good is not always good enough for everyone.)
  - II2II 2y ago
    > I don't trust any company It does not have to be a matter of trust. People make mistakes. The wrong mistake can lead to a vulnerability. Technology advances. What was considered secure 20 years ago is not considered secure today. Companies change hands and have changes in leadership. Then there is the question of: what does trusting a company mean? Their actions are the result of a multitude of minds, not a singular one.
  - andrewaylett 2y ago
    I don't think you're disagreeing with me? If you don't want Apple to have access to your passwords, don't give your passwords to Apple. The biggest problem with Keychain here isn't that it is able to share with iCloud, it's that it claims to have the ability not to (but it seems to not work) and will "upgrade" to sharing without prompting. This is a bad thing. But now we know it's happening, we can choose to avoid the product. On the other hand, Apple do write the OS and all its updates so they can steal all your passwords whenever they feel like it. And one might be inclined to assert that they just did.
    - dijit 2y ago
      Not sure if we disagree. Someone said "Apple re-activated a password sharing system and that's bad because I intentionally turned it off"- I agree. To-wit someone responded: "Well, actually I think Apple are going to do a better job of handling passwords" - which, I do not agree with given the context of reactivating the feature silently.

by II2II 2y ago

andrewaylett 2y ago

I suspect that Apple (and Google) are going to be better at maintaining my privacy (at least from anyone who isn't Apple (or Google, respectively)) than I am. For the record, there's plenty of data I wouldn't want to give either company (especially Google) but the answer there is also fairly straightforward: I don't put my passwords into my iCloud Keychain. Or, for that matter, into Google's password manager.

dijit 2y ago
I am your government. I am your doctor. I am your lawyer. I don't trust any company, let alone a foreign controlled one to have authorised access to my accounts as me. I would be held accountable if they were exposed and they sufficiently covered their tracks (and they are incentivised to try). Why should I brazenly permit this? (for the record, as a private individual I am using iCloud keychain, and for work I use 1password with its online storage: however I just make video games, I don’t have the power to destroy lives, nor do I have a responsibility to avoid it; I am merely pointing out that perfect being the enemy of good is not always good enough for everyone.)
- II2II 2y ago
  > I don't trust any company It does not have to be a matter of trust. People make mistakes. The wrong mistake can lead to a vulnerability. Technology advances. What was considered secure 20 years ago is not considered secure today. Companies change hands and have changes in leadership. Then there is the question of: what does trusting a company mean? Their actions are the result of a multitude of minds, not a singular one.
- andrewaylett 2y ago
  I don't think you're disagreeing with me? If you don't want Apple to have access to your passwords, don't give your passwords to Apple. The biggest problem with Keychain here isn't that it is able to share with iCloud, it's that it claims to have the ability not to (but it seems to not work) and will "upgrade" to sharing without prompting. This is a bad thing. But now we know it's happening, we can choose to avoid the product. On the other hand, Apple do write the OS and all its updates so they can steal all your passwords whenever they feel like it. And one might be inclined to assert that they just did.
  - dijit 2y ago
    Not sure if we disagree. Someone said "Apple re-activated a password sharing system and that's bad because I intentionally turned it off"- I agree. To-wit someone responded: "Well, actually I think Apple are going to do a better job of handling passwords" - which, I do not agree with given the context of reactivating the feature silently.