13 ms·

>> People don't want everything tied to one identity, one service, one login. I think this is exactly what _most_ people want. With password management specif

>> People don't want everything tied to one identity, one service, one login. I think this is exactly what _most_ people want. With password management specifically, Apple has had a Chrome extension available for a while now which has allowed me to use it on other browsers/platforms. Not ideal, but good enough for most. On top of that, they don't lock you in with passwords. You can easily import and export your passwords, just like you can with 1Password. Apple Music has had a web client for a long time. iTunes has been on Windows for 20+ years and Apple Music was supported via that until recently when they built an Apple Music specific app.

evilduck 2y ago
Besides the web client, https://cider.sh https://cider.sh exists and is in various distro package managers already too.
- dxbednarczyk 2y ago
  ...and is miles better than Apple's attempt at providing "support" for other platforms than their own.
lxgr 2y ago
> On top of that, they don't lock you in with passwords. Now that many sites are moving to passkeys or TOTPs, it would be great if Apple could not lock users in there as well. > Apple has had a Chrome extension available for a while now which has allowed me to use it on other browsers/platforms That's only on Windows and requires you to install iCloud tools locally, right?
- 58028641 2y ago
  The Chrome extension also works on macOS.
- ocodo 2y ago
  > it would be great if Apple could not lock users in there as well. The king of wishful thinking has entered the chat.
- hankman86 2y ago
  What is the adoption for passkeys? I do not get the impression that they will replace passwords or “social” logins anytime soon.
  - pmontra 2y ago
    I have yet to notice a site asking me a passkey.
    - blowski 2y ago
      I've found them to be a real pain in the arse because they're implemented so inconsistently. Only the biggest sites are offering them, but it's those big sites where I'm worried about locking myself out because of setting it up wrong.
      - scrollaway 2y ago
        I've locked myself out of Squarespace by setting up then subsequently removing a passkey. Doing so triggered a bug which "updated" the TOTP (that was already set up) and the backup codes. Support was absolutely deaf to the whole thing being a bug, absolutely impossible to report, and I'm sure it'll keep being an issue for years to come.
    - ciroduran 2y ago
      Funny enough, you can use a passkey to log in with Nintendo
      - paulryanrogers 2y ago
        Yet if the limit is one then you'll still need a fallback like forgot password. Because the original device may fail.
    - FeelingGood 2y ago
      They might not ask you to setup a passkey, but many sites already support it: https://passkeys.directory/ https://passkeys.directory/
- genmon 2y ago
  Here's the iCloud Passwords extension for Chrome -- works on my Mac happily, and also with Arc (which means I now get to use it just as much as Safari) https://chromewebstore.google.com/detail/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en-GB https://chromewebstore.google.com/detail/pejdijmoenmkgeppbfl...
drio0 2y ago
Is there a way to export all your passwords on a Windows PC, or from iPhone? I do not have a mac
- gumby 2y ago
  Why don’t you just install the windows app they announced?
  - drio0 2y ago
    I want to have a copy of all my passwords and Apple does not provide that I have been stung a few times by apple locking my data within their ecosystem (eg I can’t export my notes from iPhone out without a Mac, or MANUALLY copy each note which is crazy) so I refuse to use any of their apps or features unless I own my data
- AnthonyMouse 2y ago
  A more important question is, is there a way to export all your passwords after you're locked out? One of the major risks here is you permanently lose access to your One Ring to Rule Them All account and thereby all of the others. In theory you can export the data to some out-of-ecosystem backup device on a regular basis, but we all know that most people are not going to do that.
- antgiant 2y ago
  No The backup situation is terrible - Mac only - Only Passwords (no passkeys) - Only items you created (so nothing shared with you, even if you own the shared “group”) In short your only option is one at a time manual export
AnthonyMouse 2y ago
> I think this is exactly what _most_ people want. Like seven people replied to say this, but they're all missing the trick. Most people want this because they're guided to want it. If you show people the convenience but not the risk, of course they want something with an advantage and no apparent disadvantage. But the disadvantage exists, it's just not immediately obvious. Then some corporate machine learning algorithm decides that it's your day to have a bad year, or the screws only get tightened after you're already locked in, and the regret comes some time after the decision is made. Whereas the nerds who can see the inside of the machine are aware that this sort of thing happens and their response is no thank you. A starkly different preference from the people paying the most attention is a troubling sign. It's the early stages of this: https://xkcd.com/743/ https://xkcd.com/743/ The thing that gets me is that people then defend the practice because it's likely to be successful. Lots of unsophisticated people are going to put all their eggs in one basket and then have a bad time, which is a result we should be trying to prevent, not defend the people causing it because they're likely to turn a profit. Companies making money on information asymmetries and the misfortune of others is a flaw we should be looking for ways to optimize out.
- bandyaboot 2y ago
  I’m curious to know what you’re thinking as far as what bad outcome(s) will or may result from people choosing this over some other password manager.
  - AnthonyMouse 2y ago
    It's putting password management into the same basket as the device. Suppose your Apple ID gets compromised. The attacker is a jerk and decides to remote erase your device. Then they use your account for black hat stuff and get it permanently banned, or just erase everything on iCloud too. If the password manager was a different service then you'd still have the password for that service and could get in and recover your accounts on everything else. If it isn't, where's your stuff? The device and the cloud backups are both gone because they were both tied to the same compromised account. Or you just break your phone and then realize you don't know your password. You can reset your password with your email, so now you just need your email password, which is iCloud, which is the same password. Uh oh. Whereas if your eggs aren't all in the same basket, you can get a foothold somewhere. If you use a third party email service and haven't forgotten that password, you can still get your email on another device. If your password manager backs up to a third party service or your very own Raspberry Pi, you have access using a different set of credentials than the ones you forgot.
the_gipsy 2y ago
> People don't want everything tied to one identity, one service, one login. > I think this is exactly what _most_ people want. Until they don't, which always happens sooner than you would think.
delta_p_delta_x 2y ago
> I think this is exactly what _most_ people want. I couldn't agree more. I use Google's password manager because (1) it syncs everything (2) I already use Chrome everywhere (3) I can't be arsed to set up another password manager that is generally inferior in terms of integration. I don't care for the FOSS argument. I just want stuff to work and work easily. Plus, I sincerely believe Google is 'too big to fail'. If somehow Google gets hacked and my plain text passwords all get leaked, it means something huge has happened and we're all massively screwed anyway. So, whatever.
- jjav 2y ago
  > Plus, I sincerely believe Google is 'too big to fail' Google might be too big to fail (I don't think so, but could be wrong). The flip side of that is that google is too big to care. We all know from countless reports that they will evaporate your google account and everything ever associated with it, for no reason at all and zero chance of you ever being able to reach anyone to fix it. I can't see why anyone would risk anything of value to such a platform that can destroy all your content at any second for no reason with no warning.
  - Jeremy1026 2y ago
    > I can't see why anyone would risk anything of value to such a platform that can destroy all your content at any second for no reason with no warning. The only real solution to this is to self-host, locally. Which isn't feasible for the vast majority of people.
    - jjav 2y ago
      > The only real solution to this is to self-host, locally. Which isn't feasible for the vast majority of people. While that's a great solution, it is not the only one. Do business with providers that are not too big to care. The ones where you can call them up and talk to a real human who is empowered to fix your problem.
- adhamsalama 2y ago
  Why not use Bitwarden? It's better in every single way.
jajko 2y ago
> I think this is exactly what _most_ people want. No. Please stop being speaker for most of the whole world. There are people, including me or my wife who is not technical at all, who will never use anything similar from Apple. Or any similar SSO/access/security platform. Google and FB tried that decade+ ago, only fools fell for that regretful trap if the service has actually any long term added value.
- vegabook 2y ago
  He did say ‘I think’ so not speaking for the whole world
- jb1991 2y ago
  It's ironic that you suggest they should not speak for the whole world, and then use your own personal opinion as a stand-in for what you think should be the whole world's opinion.
commandersaki 2y ago
Easily export passwords, I’m not so sure. I remember trying to script this once and for each item it would prompt a password to extract the entry. Maybe the Passwords app changes this.
EVa5I7bHFq9mnYK 2y ago
Luckily, _most_ people don't buy overpriced and closed Apple devices.
- majke 2y ago
  > In the US, iPhone has a 58.81% market share There are demographics where Apple has dominance.
- MissTake 2y ago
  In the desktop world people tend to buy cheaper, yet equally as closed Windows machines.
  - tsimionescu 2y ago
    In what ways are desktop Windows boxes as closed as Apple? I would say there are many many things to fault Microsoft for, but closing down the OS has never been one of them (though that is gradually changing outside the EU, to be fair).
    - esskay 2y ago
      Counter point - in what ways is macOS 'closed' and Windows not? And I am specifically talking about macOS, not iOS.
      - Zach_the_Lizard 2y ago
        MacOS is only licensed for use in Apple branded hardware, as I understand it. Even running it in a VM could be problematic if that host isn't running MacOS.
        MissTake 2y ago
        True. However I can (and have multiple times) migrate from machine to machine without needing to reinstall everything. My work MacBook was pulled from an original Air from something like 2015, to a 2017 Pro and currently my 2019 Pro. So I’ve got apps installed on my Mac that have been installed damn near 10 years ago. Ditto my home 2015 Pro was later on migrated to a M1 Air. Hell, I’ve still some 32 Bit Steam games that still somehow run on my Air (least Steam tells me they’re 32 bit). We could play this game ad-infinitum, each finding a level of supposed “openness” but the basic facts are that neither Windows, nor MacOS are truly open. If you want open, then Linux is always going to be in the answer somewhere. Not MS Windows. And not Apple MacOS.
EGreg 2y ago
> I think this is exactly what _most_ people want. Yes, and they should have it. As open source software that a free market of hosting companies can compete on price and quality for. Not as closed source software hosting by a Big Tech oligopoly. You should be able to host your info on a server of your choice, encrypted end-to-end from your devices. That server is the one which should collect payments, manage subscriptions, do access control checks, and deliver data to others. That server is the one which should send notifications and push news updates to your devices as well as subscribers’ devices. You should always be able to migrate easily to another server, or use several at once, as fallbacks. People have learned helplessness (“oh I wish Twitter would add feature X”, “oh, I guess we all have to get a Google Plus account”, “oh, sucks that Google Plus and all my data and social connections there are going away”) because open source developers didn’t stick around long enough to make something that is good enough to compete with it, and is decentralized and federated. I can count on one hand: Mastodon. Bluesky. I am working on fixing it: https://github.com/Qbix/Platform https://github.com/Qbix/Platform Larger vision for 2025 and later: https://qbix.com/ecosystem https://qbix.com/ecosystem
itsoktocry 2y ago
>I think this is exactly what _most_ people want. This is what they think they want, until something happens and they are forced to move out of the walled garden, and have to replace everything. But, admittedly, that's Apple's bread and butter, and they've managed to avoid big controversy so far...
redbell 2y ago
> I think this is exactly what _most_ people want. I see many comments replying to the above statement, and I am no exception.. what about the saying that goes: "Don't put all your eggs in one basket"?
- nordsieck 2y ago
  > what about the saying that goes: "Don't put all your eggs in one basket"? I think it's a lot more important to decide who you want to trust. The problem is that there are a lot of small apps that end up being scams. Or they end up selling their software to scammers. Or they just don't have the ability to properly secure their system (LastPass). Apple has kind of made a name for themselves as a big company that cares about privacy and is serious about security. And they don't have the reputation for totally screwing over their customers randomly like Google. I can see a lot of people making the pragmatic decision to just keep trusting Apple instead of figuring out which other company to trust as well.

evilduck 2y ago

Besides the web client, https://cider.sh https://cider.sh exists and is in various distro package managers already too.

dxbednarczyk 2y ago
...and is miles better than Apple's attempt at providing "support" for other platforms than their own.

lxgr 2y ago

> On top of that, they don't lock you in with passwords. Now that many sites are moving to passkeys or TOTPs, it would be great if Apple could not lock users in there as well. > Apple has had a Chrome extension available for a while now which has allowed me to use it on other browsers/platforms That's only on Windows and requires you to install iCloud tools locally, right?

58028641 2y ago
The Chrome extension also works on macOS.
ocodo 2y ago
> it would be great if Apple could not lock users in there as well. The king of wishful thinking has entered the chat.
hankman86 2y ago
What is the adoption for passkeys? I do not get the impression that they will replace passwords or “social” logins anytime soon.
- pmontra 2y ago
  I have yet to notice a site asking me a passkey.
  - blowski 2y ago
    I've found them to be a real pain in the arse because they're implemented so inconsistently. Only the biggest sites are offering them, but it's those big sites where I'm worried about locking myself out because of setting it up wrong.
    - scrollaway 2y ago
      I've locked myself out of Squarespace by setting up then subsequently removing a passkey. Doing so triggered a bug which "updated" the TOTP (that was already set up) and the backup codes. Support was absolutely deaf to the whole thing being a bug, absolutely impossible to report, and I'm sure it'll keep being an issue for years to come.
  - ciroduran 2y ago
    Funny enough, you can use a passkey to log in with Nintendo
    - paulryanrogers 2y ago
      Yet if the limit is one then you'll still need a fallback like forgot password. Because the original device may fail.
  - FeelingGood 2y ago
    They might not ask you to setup a passkey, but many sites already support it: https://passkeys.directory/ https://passkeys.directory/
genmon 2y ago
Here's the iCloud Passwords extension for Chrome -- works on my Mac happily, and also with Arc (which means I now get to use it just as much as Safari) https://chromewebstore.google.com/detail/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en-GB https://chromewebstore.google.com/detail/pejdijmoenmkgeppbfl...

drio0 2y ago

Is there a way to export all your passwords on a Windows PC, or from iPhone? I do not have a mac

gumby 2y ago
Why don’t you just install the windows app they announced?
- drio0 2y ago
  I want to have a copy of all my passwords and Apple does not provide that I have been stung a few times by apple locking my data within their ecosystem (eg I can’t export my notes from iPhone out without a Mac, or MANUALLY copy each note which is crazy) so I refuse to use any of their apps or features unless I own my data
AnthonyMouse 2y ago
A more important question is, is there a way to export all your passwords after you're locked out? One of the major risks here is you permanently lose access to your One Ring to Rule Them All account and thereby all of the others. In theory you can export the data to some out-of-ecosystem backup device on a regular basis, but we all know that most people are not going to do that.
antgiant 2y ago
No The backup situation is terrible - Mac only - Only Passwords (no passkeys) - Only items you created (so nothing shared with you, even if you own the shared “group”) In short your only option is one at a time manual export

AnthonyMouse 2y ago

> I think this is exactly what _most_ people want. Like seven people replied to say this, but they're all missing the trick. Most people want this because they're guided to want it. If you show people the convenience but not the risk, of course they want something with an advantage and no apparent disadvantage. But the disadvantage exists, it's just not immediately obvious. Then some corporate machine learning algorithm decides that it's your day to have a bad year, or the screws only get tightened after you're already locked in, and the regret comes some time after the decision is made. Whereas the nerds who can see the inside of the machine are aware that this sort of thing happens and their response is no thank you. A starkly different preference from the people paying the most attention is a troubling sign. It's the early stages of this: https://xkcd.com/743/ https://xkcd.com/743/ The thing that gets me is that people then defend the practice because it's likely to be successful. Lots of unsophisticated people are going to put all their eggs in one basket and then have a bad time, which is a result we should be trying to prevent, not defend the people causing it because they're likely to turn a profit. Companies making money on information asymmetries and the misfortune of others is a flaw we should be looking for ways to optimize out.

bandyaboot 2y ago
I’m curious to know what you’re thinking as far as what bad outcome(s) will or may result from people choosing this over some other password manager.
- AnthonyMouse 2y ago
  It's putting password management into the same basket as the device. Suppose your Apple ID gets compromised. The attacker is a jerk and decides to remote erase your device. Then they use your account for black hat stuff and get it permanently banned, or just erase everything on iCloud too. If the password manager was a different service then you'd still have the password for that service and could get in and recover your accounts on everything else. If it isn't, where's your stuff? The device and the cloud backups are both gone because they were both tied to the same compromised account. Or you just break your phone and then realize you don't know your password. You can reset your password with your email, so now you just need your email password, which is iCloud, which is the same password. Uh oh. Whereas if your eggs aren't all in the same basket, you can get a foothold somewhere. If you use a third party email service and haven't forgotten that password, you can still get your email on another device. If your password manager backs up to a third party service or your very own Raspberry Pi, you have access using a different set of credentials than the ones you forgot.

the_gipsy 2y ago

> People don't want everything tied to one identity, one service, one login. > I think this is exactly what _most_ people want. Until they don't, which always happens sooner than you would think.

delta_p_delta_x 2y ago

> I think this is exactly what _most_ people want. I couldn't agree more. I use Google's password manager because (1) it syncs everything (2) I already use Chrome everywhere (3) I can't be arsed to set up another password manager that is generally inferior in terms of integration. I don't care for the FOSS argument. I just want stuff to work and work easily. Plus, I sincerely believe Google is 'too big to fail'. If somehow Google gets hacked and my plain text passwords all get leaked, it means something huge has happened and we're all massively screwed anyway. So, whatever.

jjav 2y ago
> Plus, I sincerely believe Google is 'too big to fail' Google might be too big to fail (I don't think so, but could be wrong). The flip side of that is that google is too big to care. We all know from countless reports that they will evaporate your google account and everything ever associated with it, for no reason at all and zero chance of you ever being able to reach anyone to fix it. I can't see why anyone would risk anything of value to such a platform that can destroy all your content at any second for no reason with no warning.
- Jeremy1026 2y ago
  > I can't see why anyone would risk anything of value to such a platform that can destroy all your content at any second for no reason with no warning. The only real solution to this is to self-host, locally. Which isn't feasible for the vast majority of people.
  - jjav 2y ago
    > The only real solution to this is to self-host, locally. Which isn't feasible for the vast majority of people. While that's a great solution, it is not the only one. Do business with providers that are not too big to care. The ones where you can call them up and talk to a real human who is empowered to fix your problem.
adhamsalama 2y ago
Why not use Bitwarden? It's better in every single way.

jajko 2y ago

> I think this is exactly what _most_ people want. No. Please stop being speaker for most of the whole world. There are people, including me or my wife who is not technical at all, who will never use anything similar from Apple. Or any similar SSO/access/security platform. Google and FB tried that decade+ ago, only fools fell for that regretful trap if the service has actually any long term added value.

vegabook 2y ago
He did say ‘I think’ so not speaking for the whole world
jb1991 2y ago
It's ironic that you suggest they should not speak for the whole world, and then use your own personal opinion as a stand-in for what you think should be the whole world's opinion.

commandersaki 2y ago

Easily export passwords, I’m not so sure. I remember trying to script this once and for each item it would prompt a password to extract the entry. Maybe the Passwords app changes this.

EVa5I7bHFq9mnYK 2y ago

Luckily, _most_ people don't buy overpriced and closed Apple devices.

majke 2y ago
> In the US, iPhone has a 58.81% market share There are demographics where Apple has dominance.
MissTake 2y ago
In the desktop world people tend to buy cheaper, yet equally as closed Windows machines.
- tsimionescu 2y ago
  In what ways are desktop Windows boxes as closed as Apple? I would say there are many many things to fault Microsoft for, but closing down the OS has never been one of them (though that is gradually changing outside the EU, to be fair).
  - esskay 2y ago
    Counter point - in what ways is macOS 'closed' and Windows not? And I am specifically talking about macOS, not iOS.
    - Zach_the_Lizard 2y ago
      MacOS is only licensed for use in Apple branded hardware, as I understand it. Even running it in a VM could be problematic if that host isn't running MacOS.
      - MissTake 2y ago
        True. However I can (and have multiple times) migrate from machine to machine without needing to reinstall everything. My work MacBook was pulled from an original Air from something like 2015, to a 2017 Pro and currently my 2019 Pro. So I’ve got apps installed on my Mac that have been installed damn near 10 years ago. Ditto my home 2015 Pro was later on migrated to a M1 Air. Hell, I’ve still some 32 Bit Steam games that still somehow run on my Air (least Steam tells me they’re 32 bit). We could play this game ad-infinitum, each finding a level of supposed “openness” but the basic facts are that neither Windows, nor MacOS are truly open. If you want open, then Linux is always going to be in the answer somewhere. Not MS Windows. And not Apple MacOS.

EGreg 2y ago

> I think this is exactly what _most_ people want. Yes, and they should have it. As open source software that a free market of hosting companies can compete on price and quality for. Not as closed source software hosting by a Big Tech oligopoly. You should be able to host your info on a server of your choice, encrypted end-to-end from your devices. That server is the one which should collect payments, manage subscriptions, do access control checks, and deliver data to others. That server is the one which should send notifications and push news updates to your devices as well as subscribers’ devices. You should always be able to migrate easily to another server, or use several at once, as fallbacks. People have learned helplessness (“oh I wish Twitter would add feature X”, “oh, I guess we all have to get a Google Plus account”, “oh, sucks that Google Plus and all my data and social connections there are going away”) because open source developers didn’t stick around long enough to make something that is good enough to compete with it, and is decentralized and federated. I can count on one hand: Mastodon. Bluesky. I am working on fixing it: https://github.com/Qbix/Platform https://github.com/Qbix/Platform Larger vision for 2025 and later: https://qbix.com/ecosystem https://qbix.com/ecosystem

itsoktocry 2y ago

>I think this is exactly what _most_ people want. This is what they think they want, until something happens and they are forced to move out of the walled garden, and have to replace everything. But, admittedly, that's Apple's bread and butter, and they've managed to avoid big controversy so far...

redbell 2y ago

> I think this is exactly what _most_ people want. I see many comments replying to the above statement, and I am no exception.. what about the saying that goes: "Don't put all your eggs in one basket"?

nordsieck 2y ago
> what about the saying that goes: "Don't put all your eggs in one basket"? I think it's a lot more important to decide who you want to trust. The problem is that there are a lot of small apps that end up being scams. Or they end up selling their software to scammers. Or they just don't have the ability to properly secure their system (LastPass). Apple has kind of made a name for themselves as a big company that cares about privacy and is serious about security. And they don't have the reputation for totally screwing over their customers randomly like Google. I can see a lot of people making the pragmatic decision to just keep trusting Apple instead of figuring out which other company to trust as well.