4 ms·

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is tha

by lapcat 2y ago

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In general, the presence of my passwords in the cloud is an unwanted and unnecessary liability for me. I understand that for other people, cloud storage is a benefit, and I don't wish to deprive them of that choice. Nonethless, Apple deprived me of a choice in this case.

tonyedgecombe 2y ago
> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.
- lapcat 2y ago
  > Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.
  - falcolas 2y ago
    So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.
    - squidgedcricket 2y ago
      You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.
      - falcolas 2y ago
        At least with Chrome (and stock chromium, IIRC), you don't have to sign into the browser. If you sign into any Google property, the browser will use that auth to log you in. Firefox does not, but it sure prompts the hell out of you to do so.
        lapcat 2y ago
        In Chrome Settings, You and Google, Sync and Google services, there's a toggle "Allow Chrome sign-in", which says "By turning this off, you can sign in to Google sites like Gmail without signing in to Chrome".
        falcolas 2y ago
        Sure. But it's on by default, isn't it? Just like Apple's upload is on by default. Also, chromebooks require such a sign-in as well, and I'll bet they enable that syncing by default as well. Singling out Apple here is kinda silly when they're encrypted (if you don't trust Apple to tell the truth there, running their OS at all is risky), and when the behavior is that which we'd expect. And at the end of the day, using Apple's password manager is mostly (exceptions including wifi passwords) optional.
        lapcat 2y ago
        > Just like Apple's upload is on by default. The blog post is about how it was off and then got silently toggled on. > Singling out Apple here I'm not a journalist covering tech companies. I'm an Apple user complaining about something that happened on my own Apple devices. It's silly to characterize that as "singling out Apple". I do use Chrome, though, and it never silently switched that toggle back on. If it did, I'd definitely blog about that.
      - EasyMark 2y ago
        Why wouldn't you use local solutions for that? There is no profitability in that for companies and a lot of headaches to maintain another solution that they are just going to see as a money-sink. Companies pretty much -have- to provide a password solution on a modern OS, but they don't have to provide 2. It will have to be done by you with something like KeepassXC or Vaultwarden or something.
    - mafuy 2y ago
      I think firefox asked me what I want to sync
      - EasyMark 2y ago
        It does, and you can configure it at any point, per browser, but it's just a click box. Someone could come in behind you and click on password I think to sync up passwords. Maybe it should ask for your sync password if you do that? It doesn't seem to right now, I just changed it with no complaints. That said I only keep unimportant passwords in firefox as a convenience, banking etc go in bitwarden
  - SoftTalker 2y ago
    I disabled all iCloud stuff the first day I had my iPhone. Just checked and it's still off.
  - tonyedgecombe 2y ago
    >You clearly didn't even read the article. Of course not, I come here for the comments.
npteljes 2y ago
>[manufacturer] deprived me of a choice in this case This seems to be the industry trend with these remotely managed machines, like Apple or Windows PCs. The update mechanism, for better or worse, takes power from the user and assigns it back to the manufacturer / service provider. It's something that the software world would have considered a Trojan horse some 20 years ago, an extension of control to the end users machine, for someone other than the end user themselves. I'm not sure where I'm going with this. What's for sure is that the IT zeitgeist really changed over the decades.
- adamc 2y ago
  Might be good for some "average" user but strikes me as bad for software developers or other folks with particular need for tight control.
  - evoke4908 2y ago
    At work, we discovered that our product doesn't work with Windows 11 because Microsoft forcibly installed W11 on our demo machine the night prior. If you're curious, it's because the W11 Bluetooth stack is somehow even more broken than W10. Our entirely standard Bluetooth widget can't communicate with W11 PCs and there's really no good way to discover how or why. Bluetooth support is so bad in Windows that I've been assigned to start porting all our software over to Linux. I could go on for hours over this. Windows is so bad.
- mixmastamyk 2y ago
  The war on general purpose computing has already been won, over the average consumer. Pray they don’t finish the job. </Vader>
mcsniff 2y ago
The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission.
- lapcat 2y ago
  > The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission. Why are you being repeatedly, needlessly pedantic? Everyone knows what I meant (including you, who chose to misinterpret). Your other comment was also pointless: "that's still choosing Mac over Linux and every day you continue to make that choice." https://news.ycombinator.com/item?id=42016888 https://news.ycombinator.com/item?id=42016888 You can play with your own ultra-strict definitions of "own" and "choose", but please do it in your own mind, and don't pester us with them in these comments. It adds absolutely nothing to the conversation.
  - eadmund 2y ago
    I don’t think that’s a terribly kind response. There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means. I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice. Those may all be defensible choices. They may even be correct. But they’re still choices. In your particular case, given that you appear to support yourself by selling iOS apps, it probably makes sense to keep using Apple devices. Retraining to write software running on Linux would be work. And few Linux users would buy software anyway. But if you ever get tired of using OSes you can’t control on devices you can’t control, and want to write software to do what you want, you might want to come on over to Linux. It’s pretty fun!
    - lapcat 2y ago
      > There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means. No, it's not what the word meant. What a word means depends on context. If I had simply said, "The good news is that the device was in my home under my observation", then the commenter "mcsniff" would have no opportunity to go off on a rant about "ownership" and "control". Or maybe you're going to argue pedantically that it's not "my" home, because I'm a renter? Or would you argue with someone with a mortgage that it's not "your" home, it's the bank's home? That's just pointless pedantry that clarifies nothing and benefits nobody. > I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice. Everything is a choice. Therefore it's a tautology and adds zero to the conversation. Your comment was a choice. My comment is a choice. Choice choice choice choice. So what?
claviska 2y ago
I had a similar but more concerning experience. I enabled family sharing (years ago when it was newer) and suddenly my spouse had access to many (all?) of MY passwords in HER keychain. I never knowingly granted access or put any passwords in a non-personal group — it just happened like magic.
jesseendahl 2y ago
@lapcat I noticed this part of your post: >The only way to see the contents of iCloud Keychain is on an Apple device with iCloud Keychain enabled. You can't even see anything on the icloud.com website. FYI this is because of all contents of iCloud Keychain are end-to-end encrypted, such that only your devices are able to decrypt the data. Apple’s servers do not have access to the contents of a user’s iCloud Keychain. You might find this article interesting: https://support.apple.com/guide/security/icloud-keychain-security-overview-sec1c89c6f3b/web https://support.apple.com/guide/security/icloud-keychain-sec... Also the second part of this Blackhat talk, titled “Synchronizing Secrets” is very interesting and details the design and security architecture of iCloud Keychain: https://youtu.be/BLGFriOKz6U https://youtu.be/BLGFriOKz6U The relevant part of the talk starts at 22:40.
EasyMark 2y ago
wouldn't you assume that if you log into a machine with your apple "cloud" credentials that various programs would sync up? I don't see how it could happen any other way? It would be nice if they had a pop up like they do for app permissions though. Perhaps submit a radar on it as a regular user? https://lickability.com/blog/5-tips-for-filing-radars/ https://lickability.com/blog/5-tips-for-filing-radars/
- retrochameleon 2y ago
  No. Not without allowing me to configure what gets synced and what does not.
neuralRiot 2y ago
I don’t know if it’s true but when backing up locally via Itunes it warns you that if you don’t encrypt the backup, passwords won’t be saved. I don’t save backups on icloud.

by lapcat 2y ago

tonyedgecombe 2y ago

> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.

lapcat 2y ago
> Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.
- falcolas 2y ago
  So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.
  - squidgedcricket 2y ago
    You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.
    - falcolas 2y ago
      At least with Chrome (and stock chromium, IIRC), you don't have to sign into the browser. If you sign into any Google property, the browser will use that auth to log you in. Firefox does not, but it sure prompts the hell out of you to do so.
      - lapcat 2y ago
        In Chrome Settings, You and Google, Sync and Google services, there's a toggle "Allow Chrome sign-in", which says "By turning this off, you can sign in to Google sites like Gmail without signing in to Chrome".
        falcolas 2y ago
        Sure. But it's on by default, isn't it? Just like Apple's upload is on by default. Also, chromebooks require such a sign-in as well, and I'll bet they enable that syncing by default as well. Singling out Apple here is kinda silly when they're encrypted (if you don't trust Apple to tell the truth there, running their OS at all is risky), and when the behavior is that which we'd expect. And at the end of the day, using Apple's password manager is mostly (exceptions including wifi passwords) optional.
        lapcat 2y ago
        > Just like Apple's upload is on by default. The blog post is about how it was off and then got silently toggled on. > Singling out Apple here I'm not a journalist covering tech companies. I'm an Apple user complaining about something that happened on my own Apple devices. It's silly to characterize that as "singling out Apple". I do use Chrome, though, and it never silently switched that toggle back on. If it did, I'd definitely blog about that.
    - EasyMark 2y ago
      Why wouldn't you use local solutions for that? There is no profitability in that for companies and a lot of headaches to maintain another solution that they are just going to see as a money-sink. Companies pretty much -have- to provide a password solution on a modern OS, but they don't have to provide 2. It will have to be done by you with something like KeepassXC or Vaultwarden or something.
  - mafuy 2y ago
    I think firefox asked me what I want to sync
    - EasyMark 2y ago
      It does, and you can configure it at any point, per browser, but it's just a click box. Someone could come in behind you and click on password I think to sync up passwords. Maybe it should ask for your sync password if you do that? It doesn't seem to right now, I just changed it with no complaints. That said I only keep unimportant passwords in firefox as a convenience, banking etc go in bitwarden
- SoftTalker 2y ago
  I disabled all iCloud stuff the first day I had my iPhone. Just checked and it's still off.
- tonyedgecombe 2y ago
  >You clearly didn't even read the article. Of course not, I come here for the comments.

npteljes 2y ago

>[manufacturer] deprived me of a choice in this case This seems to be the industry trend with these remotely managed machines, like Apple or Windows PCs. The update mechanism, for better or worse, takes power from the user and assigns it back to the manufacturer / service provider. It's something that the software world would have considered a Trojan horse some 20 years ago, an extension of control to the end users machine, for someone other than the end user themselves. I'm not sure where I'm going with this. What's for sure is that the IT zeitgeist really changed over the decades.

adamc 2y ago
Might be good for some "average" user but strikes me as bad for software developers or other folks with particular need for tight control.
- evoke4908 2y ago
  At work, we discovered that our product doesn't work with Windows 11 because Microsoft forcibly installed W11 on our demo machine the night prior. If you're curious, it's because the W11 Bluetooth stack is somehow even more broken than W10. Our entirely standard Bluetooth widget can't communicate with W11 PCs and there's really no good way to discover how or why. Bluetooth support is so bad in Windows that I've been assigned to start porting all our software over to Linux. I could go on for hours over this. Windows is so bad.
mixmastamyk 2y ago
The war on general purpose computing has already been won, over the average consumer. Pray they don’t finish the job. </Vader>

mcsniff 2y ago

The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission.

lapcat 2y ago
> The device isn't "owned by you and under your control" if your passwords were synced without your doing or permission. Why are you being repeatedly, needlessly pedantic? Everyone knows what I meant (including you, who chose to misinterpret). Your other comment was also pointless: "that's still choosing Mac over Linux and every day you continue to make that choice." https://news.ycombinator.com/item?id=42016888 https://news.ycombinator.com/item?id=42016888 You can play with your own ultra-strict definitions of "own" and "choose", but please do it in your own mind, and don't pester us with them in these comments. It adds absolutely nothing to the conversation.
- eadmund 2y ago
  I don’t think that’s a terribly kind response. There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means. I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice. Those may all be defensible choices. They may even be correct. But they’re still choices. In your particular case, given that you appear to support yourself by selling iOS apps, it probably makes sense to keep using Apple devices. Retraining to write software running on Linux would be work. And few Linux users would buy software anyway. But if you ever get tired of using OSes you can’t control on devices you can’t control, and want to write software to do what you want, you might want to come on over to Linux. It’s pretty fun!
  - lapcat 2y ago
    > There’s nothing pedantic about pointing out that as an Apple product user you are not actually in control of the device which is purportedly yours. That’s not an ‘ultra-strict definition’ of control: it’s just what the word means. No, it's not what the word meant. What a word means depends on context. If I had simply said, "The good news is that the device was in my home under my observation", then the commenter "mcsniff" would have no opportunity to go off on a rant about "ownership" and "control". Or maybe you're going to argue pedantically that it's not "my" home, because I'm a renter? Or would you argue with someone with a mortgage that it's not "your" home, it's the bank's home? That's just pointless pedantry that clarifies nothing and benefits nobody. > I think that it adds a ton to the conversation to note that using Apple software is a choice. Continuing to use Apple software, even after Apple upload all your passwords to iCloud, is a choice. Not switching to alternatives is a choice. Everything is a choice. Therefore it's a tautology and adds zero to the conversation. Your comment was a choice. My comment is a choice. Choice choice choice choice. So what?

claviska 2y ago

I had a similar but more concerning experience. I enabled family sharing (years ago when it was newer) and suddenly my spouse had access to many (all?) of MY passwords in HER keychain. I never knowingly granted access or put any passwords in a non-personal group — it just happened like magic.

jesseendahl 2y ago

@lapcat I noticed this part of your post: >The only way to see the contents of iCloud Keychain is on an Apple device with iCloud Keychain enabled. You can't even see anything on the icloud.com website. FYI this is because of all contents of iCloud Keychain are end-to-end encrypted, such that only your devices are able to decrypt the data. Apple’s servers do not have access to the contents of a user’s iCloud Keychain. You might find this article interesting: https://support.apple.com/guide/security/icloud-keychain-security-overview-sec1c89c6f3b/web https://support.apple.com/guide/security/icloud-keychain-sec... Also the second part of this Blackhat talk, titled “Synchronizing Secrets” is very interesting and details the design and security architecture of iCloud Keychain: https://youtu.be/BLGFriOKz6U https://youtu.be/BLGFriOKz6U The relevant part of the talk starts at 22:40.

EasyMark 2y ago

wouldn't you assume that if you log into a machine with your apple "cloud" credentials that various programs would sync up? I don't see how it could happen any other way? It would be nice if they had a pop up like they do for app permissions though. Perhaps submit a radar on it as a regular user? https://lickability.com/blog/5-tips-for-filing-radars/ https://lickability.com/blog/5-tips-for-filing-radars/

retrochameleon 2y ago
No. Not without allowing me to configure what gets synced and what does not.

neuralRiot 2y ago

I don’t know if it’s true but when backing up locally via Itunes it warns you that if you don’t encrypt the backup, passwords won’t be saved. I don’t save backups on icloud.