[HN Gopher] Apple is launching its own password manager app
       ___________________________________________________________________
        
       Apple is launching its own password manager app
        
       Author : kelthuzad
       Score  : 193 points
       Date   : 2024-06-10 18:23 UTC (4 hours ago)
        
 (HTM) web link (techcrunch.com)
 (TXT) w3m dump (techcrunch.com)
        
       | chrisbolt wrote:
       | https://news.ycombinator.com/item?id=40636292
        
       | boringg wrote:
       | Password manager apps have been put on notice.
        
         | teolandon wrote:
         | Not while people can't use the Apple one on Linux or Android.
        
           | cheeze wrote:
           | I mean, my parents will immediately move to this from
           | BitWarden.
           | 
           | There is still a place for password managers, but if I'm the
           | LastPass CEO, writing is on the wall with this
           | announcement... They will see a large exodus of customers
           | that use Apple OS.
        
           | criddell wrote:
           | I think for a lot of the password managers out there, the
           | majority of their revenue comes from Apple users. The ones
           | that don't rely on Apple users will be fine.
        
         | recursive wrote:
         | Put on notice? What's better about this than 1password?
        
       | mmanfrin wrote:
       | Pointless if it doesnt have cross platform. Apple devices already
       | basically have a password manager, the main reason more people
       | don't use it it is because it doesnt also work on android or
       | windows, not because it's not a standalone app called Passwords.
        
         | wwalexander wrote:
         | It works on Windows.
        
         | toddmorey wrote:
         | It does work on windows; the mentioned that. No word yet on
         | Android.
        
           | Hamuko wrote:
           | No dedicated app on Windows though, it'll be part of their
           | existing iCloud Windows application.
        
         | norman784 wrote:
         | The password manager that we have today is terrible, that's why
         | people are not using it.
        
         | donohoe wrote:
         | Hardly. While not everyone is entirely within the Apple eco-
         | system a huge number of people are that go beyond the necessary
         | critical mass. Apple already built this into the OS they just
         | kept it under the clunky Settings UI - so seems like a logical
         | and low-effort move.
         | 
         | If the Family Sharing aspects are well done I'd happily say
         | goodbye to my 1Password subscription.
        
           | vundercind wrote:
           | Being in system settings makes sense to me. Having the place
           | to see the same stuff on macOS be _Safari's_ settings window
           | is the bizarre part.
           | 
           | Regardless, I've been using it for years now. Works fine.
           | Better UI will be nice assuming this doesn't come with a
           | bunch of updates that somehow manage to make it work less-
           | well.
        
         | saithier wrote:
         | They did say there was a windows client in the keynote.
        
         | jrexilius wrote:
         | My approach has been to move it out of the vendor OS entirely
         | and embedd it in the keyboard. I'll be releasing this as open
         | source (hardware & software) soon:
         | 
         | https://www.anomie.tech/products/anigma/ce/
        
           | throwaway48476 wrote:
           | Any connection to what bunnie is doing with precursor?
        
             | jrexilius wrote:
             | No connection other than being a fan. I started working on
             | my (simpler) approach before precursor was launched and
             | think there is a place for both, but I'm a big fan of all
             | the work he and his team are doing.
        
         | r0m4n0 wrote:
         | Agreed, for me it needs a solid webapp too. I reference
         | personal credentials on my corp laptop and can't/won't login to
         | anything that's in the system and am unable to install any
         | unauthorized apps.
        
         | throw0101d wrote:
         | > _Pointless if it doesnt have cross platform._
         | 
         | As mentioned in another news article on the topic:
         | 
         | > It also syncs with PCs via the iCloud for Windows app.
         | 
         | * https://www.theverge.com/2024/6/10/24175505/apple-
         | password-a...
         | 
         | and in the keynote itself:
         | 
         | * https://www.youtube.com/watch?v=RXeOiIDNNek&t=59m32s
        
           | pdpi wrote:
           | Last I tried it, iCloud for Windows didn't integrate with
           | Firefox, though.
        
             | _JamesA_ wrote:
             | Or Linux.
        
             | Someone wrote:
             | I would think it would be Firefox which would have to
             | support iCloud for Windows.
             | 
             | If password managers could interfere with password fields
             | in Firefox without its help, malware could do that, too.
             | 
             | Or is there a generic password manager API on Windows that
             | Apple doesn't implement?
        
               | ivan_gammel wrote:
               | 1Password, for example, has a plugin for Firefox.
               | Something that you would expect in MVP for any password
               | manager.
        
               | zchrykng wrote:
               | With Firefox at 2.93% [1] percent market share, doesn't
               | seem like many people would put it in the MVP.
               | 
               | 1:
               | https://en.wikipedia.org/wiki/Usage_share_of_web_browsers
        
           | bastawhiz wrote:
           | And for those of us without an iPhone?
        
             | pavel_lishin wrote:
             | Then we're not their target demographic.
        
             | nani8ot wrote:
             | Being locked into the eco system is my main reason for
             | avoiding Apple products. Switching from an iPhone to an
             | Android phone was painless for me because I didn't use any
             | of the Apple services (iMessage, iCloud, Passwords). If I
             | had to simultaneously switch from Passwords to Bitwarden
             | would've been time consuming and annoying.
        
           | wiseowise wrote:
           | Just need to install windows on my phone, duh.
        
       | spike021 wrote:
       | I started using Keychain pretty much primarily this year (other
       | than 1Password at work) and it works pretty seamlessly for me
       | (granted Apple devices only). Even the Chrome extension works
       | quickly as if it were a native part of Chrome.
       | 
       | Glad they're splitting it out of System Settings into a dedicated
       | app.
       | 
       | I've also started migrating family members to it. It'll be way
       | easier for the less technical people since it's already tightly
       | integrated in the devices and OS they use everyday.
        
         | mdeeks wrote:
         | Does the Chrome extension still require you to enter a six
         | digit code every day to even use it? When I tried it this was
         | incredibly annoying and I switched back to 1password shortly
         | after.
        
           | spike021 wrote:
           | Not sure that it's every day but I haven't been too bothered
           | by it. It's not unlike the security policies where I work. So
           | needing to type in a OTP isn't out of my normal routine.
        
           | eastbound wrote:
           | It's important, otherwise that means any locally-running
           | binary (maven, npm) can steal all of your passwords, since
           | they are in clear on your computer.
        
             | criddell wrote:
             | Does macOS sandbox things like maven or npm? Do they need
             | read access for everything the user can see?
        
         | duxup wrote:
         | I often was looking to see "do I have that in keychain" and ...
         | I'd forget where to find it as it wasn't a dedicated app.
        
           | Toutouxc wrote:
           | You're both talking about iOS, right? Because on the Mac it's
           | always been a dedicated app.
        
             | duxup wrote:
             | Yes, I am for sure thinking of iOS.
        
             | spike021 wrote:
             | Yeah. But even for Mac it's always been more of a technical
             | utility app. When I say that it feels more akin to Disk
             | Utility than the Notes app (in terms of who it's meant
             | for).
        
               | lxgr wrote:
               | These days it even shows you a popup that asks something
               | along the lines of "are you sure you want this app and
               | not the iCloud Keychain tab in System Preferences".
        
       | toddmorey wrote:
       | This is welcome. Central password management really should be an
       | OS feature. Drives me crazy that every browser I use has a
       | different credentials store and sync service.
        
         | sahila wrote:
         | Why do you have the need to use different browsers? Use the one
         | you like on all your devices is easy.
        
           | lxgr wrote:
           | Not everybody appreciates platform lock-in (whether the
           | platform is a browser or an OS).
        
       | wwalexander wrote:
       | One of my biggest feature wishes finally come true. A few updates
       | back they made the Passwords section in Settings one level less
       | deep, and I was very frustrated they realized it should be easily
       | accessible but didn't bother making it a standalone app when
       | Keychain existed on Mac.
        
       | shallichange wrote:
       | Why would I use it over Bitwarder?
        
         | fckgw wrote:
         | Because it's already built into the devices I use
        
           | block_dagger wrote:
           | Bitwarden integrates pretty well on Apple devices/apps
           | already, although I guess you could save a tap by using a
           | native app.
        
         | HaZeust wrote:
         | I'll be trying this out, but moving me from Bitwarden will
         | prove quite a feat - especially since it was the best option
         | for me after trying over 10 password managers while I was still
         | window shopping for one.
        
           | nsbk wrote:
           | I'm in the same boat. I really enjoy Bitwarden but I'm
           | willing to give this a try to see if it's as good as it could
           | be
        
             | throwawayq3423 wrote:
             | I will need a tool to transfer over all the pws, doing that
             | manually is a non starter
        
               | nsbk wrote:
               | Sounds like a fun project to work on
        
               | throwawayq3423 wrote:
               | Most pw mangers already have one. That's how I started on
               | BitWarden
        
         | Hamuko wrote:
         | It's native and not Electron shit?
        
           | HaZeust wrote:
           | What's wrong with Electron?
        
             | AnonC wrote:
             | Electron apps are usually (not always necessarily) sluggish
             | and don't support native UI paradigms or keyboard shortcuts
             | or navigation. The Bitwarden desktop app is one of the bad
             | ones.
        
             | Hamuko wrote:
             | Disk space for one. The Bitwarden macOS application is
             | around 390 MB. For comparison, Firefox is 388 MB. They're
             | usually much worse from a CPU and RAM perspective too.
        
           | bowsamic wrote:
           | Considering I only ever use it as a Chrome plugin anyway,
           | that's not much of a sell
        
         | AnonC wrote:
         | Mainly depends on which platforms you use. If you're using
         | Bitwarden on Android and/or Linux, then this isn't a
         | replacement. If you're on Apple's iOS/iPadOS/macOS or are on
         | Windows, you can use this. These are also native apps, unlike
         | Bitwarden's Electron monstrosity on the desktop.
         | 
         | Bitwarden has been lagging in implementing any consumer
         | features for some years now (custom item types has been on the
         | roadmap for six years and is still not done). Except for secure
         | notes in Bitwarden, I don't think you'd miss anything else in
         | this app. Bitwarden is spending money and focus on the
         | enterprise, just like 1Password has been. For the consumer
         | segment, neither of these are good enough now.
        
           | jimt1234 wrote:
           | > Bitwarden has been lagging in implementing any consumer
           | features for some years now...
           | 
           | This is actually the reason why I like Bitwarden. They don't
           | seem to be constantly trying to push unwanted features on me.
           | I've always been a fan of the first "rule" of the Unix
           | Philosophy: _do one thing well_.
        
         | lawn wrote:
         | You probably shouldn't.
         | 
         | But it might make other people who don't use a password manager
         | start using one.
        
       | Sprotch wrote:
       | For this to catch on it needs to have a Chrome app - that's the
       | only way employers let you use a password manager
        
         | fckgw wrote:
         | There's been a Keychain/iCloud Passwords chrome extension for
         | years already
        
           | Bnjoroge wrote:
           | really? what's the name?
        
             | selykg wrote:
             | https://chromewebstore.google.com/detail/icloud-
             | passwords/pe...
        
               | lxgr wrote:
               | It's worth noting that this is Windows only, and needs
               | you to install the iCloud native client there (which
               | might not be an option on managed devices).
               | 
               | It doesn't work as a standalone Chrome extension in the
               | way that 1Password or Bitwarden do, for example.
        
       | egypturnash wrote:
       | So... this new app does _most_ of what the depreciated "Keychain"
       | app did, except now it's got a iOS-looking UI. Huzzah, I guess,
       | the "passwords" section in the iOS-restyled system prefs sure
       | wasn't substituting for Keychain for me. Passwords doesn't appear
       | to handle secure notes, though, and I still have a few of those,
       | too.
       | 
       | I still really hate the iOS-restyled system prefs. Tiny
       | unresizable text, a long vertical scroll. I can't find a damn
       | thing in it and just use the search bar every time and feel
       | faintly annoyed about it.
        
         | selykg wrote:
         | I noticed a "Notes" section in password items. So, I guess in
         | theory you could utilize those.
         | 
         | But my biggest one is wanting to store secure files. Think
         | copies of a drivers license, signed documents or various certs
         | and keys. That's not being covered here either for me sadly.
         | It's not a super common situation for me so I can probably find
         | an alternative app for that purpose.
         | 
         | Edit: Also for notes, I'd just password protect something in
         | the Notes app. But that's just me.
        
           | catoc wrote:
           | For iOS & Mac https://thevault-app.com does exactly that for
           | me. Storing PDFs, or just plain images of passport, drivers
           | license etc (in addition to passwords). It's a bit on the
           | technical site (eg, also has cmd: prefix for terminal
           | commands etc)
        
         | spike021 wrote:
         | We've been able to lock notes in the Notes app for a while
         | either with a password or Touch/FaceID.
        
           | egypturnash wrote:
           | Oh, you can? I should look into that then, thanks. I've
           | vaguely settled on Notes as "I guess this is the least shitty
           | replacement for the specific way Evernote fit I to my life"
           | but have never actually sat down with its manual to see what
           | it can actually do.
           | 
           | Hopefully Adobe won't decide to start shitting a bunch of
           | authorization credentials into private Notes the way they
           | took over the Private Notes section of Keychain.
        
       | tarentel wrote:
       | If this supports OTP, and ideally profiles, I'd likely cancel my
       | 1Password subscription. I've been waiting for Apple to release
       | something like this for a long time and surprised it took them
       | this long.
        
         | Lx1oG-AWb6h_ZG0 wrote:
         | iOS already supports OTP, it's just buried in Settings >
         | Passwords > Set up verification code. Once you do that, it's
         | seamless - it autofills in all my site and works beautifully in
         | chrome/edge/firefox even in my PCs
        
         | alt227 wrote:
         | Keychain has been built into all apple devices for ages, and
         | all support OTP and seamless sharing across all your devices.
         | Genuinely interested to know why you have been using 1Password
         | when apple will already do it all for you? Did you not know?
        
       | whitepoplar wrote:
       | I hope it includes credit cards, rewards programs, IDs/Passports,
       | etc. so that I can cancel my 1Password subscription.
        
       | alberth wrote:
       | What's new besides management of passwords being move from
       | Settings, now into it's own dedicated app?
        
       | jwells89 wrote:
       | Timely with how official support for the old 1Password 7 apps
       | probably won't be continued for too much longer, with 1Password
       | pushing users over to the notably worse v8 apps. I'll probably
       | switch.
        
         | baryphonic wrote:
         | Interesting. I liked the 1Password 6 UI, was frustrated with
         | 1Password 7 and have been loving 1Password 8 so far. Version 7
         | seemed really clunky when I needed to do certain workflows.
        
           | jwells89 wrote:
           | What I dislike about the 7 - 8 transition is that it went
           | from feeling like a handcrafted Mac app to an
           | indistinguishable generic SaaS thing, which is exacerbated by
           | 8 being built with Electron (which brings dozens of little
           | papercuts that are difficult to smooth out, even if the dev
           | cares to try to).
        
         | lowbloodsugar wrote:
         | Right. 1Password 7 is the last one to have private vaults.
         | After that dies, I have no reason to use 1Password over
         | anything else. SSH? Yeah, need that for work - which absolutely
         | bans storing those on the cloud.
        
         | selykg wrote:
         | The biggest reason I'm moving away from 1Password is the
         | abysmal support for Safari Profiles. It's so bad it's
         | ridiculous.
         | 
         | Right now for instance I have a Personal profile, and a few
         | work specific ones around admin, development, and my day-to-day
         | work to split things off easily. I have 1Password unlocked in
         | one profile and it works in that, but if I switch to any other
         | profile it needs to be unlocked, then it tells me it needs to
         | reload the extension. Reloading it doesn't do anything but
         | break it again. I have to fully quit Safari then it works again
         | for some unknown amount of time then falls apart completely
         | soon after (probably laptop sleep or something like that).
         | 
         | Just a shitshow all around from 1Password anymore. How the
         | mighty have fallen due to profits and investors.
        
       | alt227 wrote:
       | So are they literally just launching an icon which opens
       | keychain?
        
         | drcongo wrote:
         | No.
        
       | GeekyBear wrote:
       | I'll be interested to see if there is improved support for
       | handling and syncing passkeys to multiple personal devices.
       | 
       | I'm a bit nervous after hearing about people having early adopter
       | issues.
       | 
       | Hopefully there is some sort of fallback if something extreme
       | like a house fire manages to destroy all of your personal devices
       | at once.
        
       | pkamb wrote:
       | My annoyance with Keychain has been that items kind of appear
       | there as I type in a username and password on the web. Feels
       | rather ephemeral, like old "saved passwords" in Internet Explorer
       | or whatever. Feels like I'm one browser cookie reset away from
       | losing everything.
       | 
       | Whereas with 1Password I use a separate app to CREATE a new Login
       | file for an app/website/anything. I can save that file with as
       | much or a little information filled out as desired. Can create
       | arbitrary info files for Passports, library membership cards,
       | etc. I know the information for each is forever stored exactly as
       | I created it, always syncing, never overwritten when I type in a
       | different password and accidentally hit "save" in a webform.
       | 
       | I hope the new Apple Passwords app is more like the later; if so
       | I would switch.
        
       | jaskaransainiz wrote:
       | Nice
        
       | FredPret wrote:
       | Good! I've typed [?]-spacebar + "password" about a million times
       | now
        
       | ipqk wrote:
       | I've been an avid 1Password user for over 10 years, but since
       | they gone full-throttle targeting the enterprise market, I'm
       | getting more and more annoyed. It's increasingly buggy (right
       | now, it thinks I haven't migrated from 1p7 which causes annoying
       | interstitials that I can't close. Over a month and no fix yet.).
       | They killed standalone vaults. Obvious feature requests (e.g
       | archive an entire vault) sit there for years untouched. The value
       | is increasingly not there anymore for me, and here's hoping I can
       | finally jump ship this fall.
        
         | alx__ wrote:
         | Is your computer managed by Jamf? I had that 1Password 7 issue
         | because of policy issue
        
         | bowsamic wrote:
         | I've used Bitwarden for a while now and it has been so better
         | than LastPass or 1Password ever was for me. I never understood
         | the 1Password hype, it was easily the worst experience of any
         | password manager I tried.
        
           | lxgr wrote:
           | Bitwarden gets my vote too.
           | 
           | Besides just working as expected, it importantly supports
           | self-hosting. I don't currently make use of that, but have
           | given it a try and it's great as well.
           | 
           | Having alternatives to the SaaS (currently very reasonably
           | priced) is invaluable.
        
         | ents wrote:
         | Same here. Hoping I can jump ship before next renewal.
        
         | drcongo wrote:
         | I'm only still on it because of team use, but if Apple's thing
         | supports teams I'm gonna be _so_ happy to get rid of it.
         | 
         | I've been using it for nearly 20 years and it's been going down
         | hill fast for the last 5, but 1Password 8 is an absolute clown
         | car. It hijacks your passkey logins meaning that authenticating
         | with Tailscale for me has gone from a single touch of the
         | TouchID button on my Mac, to 1) click button that says "Unlock
         | 1Password", 2) Click it again because it did fuck all the first
         | time, 3) hit the global hotkey for 1Password, 4) open 1Password
         | via Alfred because the hotkey has decided to stop working
         | again, 5) touch the TouchID button to unlock 1Password, 6)
         | switch back to the browser to find that my Tailscale auth has
         | timed out, 7) back to iTerm to initiate the auth again, 8) if
         | I'm lucky, I can now touch the TouchID button to use my Apple
         | passkey, if I'm not, it's back to step 1.
         | 
         | I'd challenge anyone to name an app that has been ruined more
         | by VC money than 1Password.
        
           | anonexpat wrote:
           | Evernote.
        
         | dylan604 wrote:
         | I have been fighting switching to the SaaS version. Paying a
         | monthly fee for access to my passwords is highway robbery. I do
         | not want/need any of these other "services" they forced upon
         | me. I have trying Apples keychain, but that migration is slow
         | and a total pain in the ass. And it's not even a good
         | replacement.
         | 
         | I'm sure 1Password doesn't care one iota about loosing
         | individual users with attitudes like this. Until the forced to
         | a monthly rent seeking hand in my pocket policy was deployed, I
         | had been a vocal advocate for 1Pass. Now, they're about to
         | loose me altogether
        
           | spike021 wrote:
           | Interesting. Earlier this year I migrated passwords out of
           | 1Password and a few from LastPass and Apple Keychain
           | supported both easily. Just not more complex types of
           | credentials. Every password and website was imported
           | correctly as expected. If not I have yet to notice.
        
             | kshacker wrote:
             | I tried to do the same and failed. The questions were 1)
             | multi-browser support - I use Safari, Chrome, Firefox and
             | Opera - there is a reason for this and I do not want to
             | authorize some of my browsers everyday to serve passwords,
             | 2) ease of use for family with different level of
             | computer/iOS proficiency amongst them. As of now, they are
             | happily running on 1password, but I will be happy to try
             | again this year and next.
        
               | dylan604 wrote:
               | On top of that having to open up system preferences to
               | add a new entry was just insane. Hopefully, this new UI
               | into it will lessen that pain.
        
           | JumpCrisscross wrote:
           | > _Paying a monthly fee for access to my passwords is highway
           | robber_
           | 
           | It would be. Fortunately, 1Password doesn't do that [1].
           | 
           | You're paying for an important piece of software to be
           | maintained.
           | 
           | > _I 'm sure 1Password doesn't care one iota about loosing
           | individual users with attitudes like this_
           | 
           | Probably not. Emphasis on attitude.
           | 
           | [1] https://support.1password.com/frozen-account/
        
             | dylan604 wrote:
             | This entire assumption that I'm a freeloader is absolute
             | bullshit. I've bought and paid for my copies of 1Password
             | and have even purchased it for others. You can take that
             | freeloader name calling and shove it right back in the
             | place you found it. I'm quite frankly tired of it.
             | 
             | We can have upgrades and working software that gets updates
             | without monthly fees to do it. I also do not need their
             | cloud and only features. They intentionally removed the
             | local vaults specifically to force you to use their cloud.
             | That was the last straw for me.
        
               | JumpCrisscross wrote:
               | > _assumption that I 'm a freeloader_
               | 
               | Where did I or OP say this?
               | 
               | > _can have upgrades and working software that gets
               | updates without monthly fees to do it_
               | 
               | It's a bad financial model.
               | 
               | > _intentionally removed the local vaults_
               | 
               | This is a valid disagreement.
        
               | dylan604 wrote:
               | people go back and edit their comments silently after
               | being called out all the time around here
        
               | stouset wrote:
               | > We can have upgrades and working software that gets
               | updates without monthly fees to do it.
               | 
               | No, the last twenty years has show us that we can't.
               | 
               | If you want developers to perform ongoing work on their
               | products, you need to accept a model where there's
               | ongoing pay for that work.
        
           | buzzerbetrayed wrote:
           | 1Password has the most reasonable pricing out of just about
           | any SaaS company. $1/user/month if you're on a family plan.
           | $3/month for individuals. And they provide a great service.
           | 
           | Strongly disagree that they're part of the group of SaaS
           | companies trying to price gouge their users.
        
             | dylan604 wrote:
             | Cloud only, and they removed local storage of the vaults.
             | If I'm somewhere that doesn't have internet connectivity,
             | what happens then?
             | 
             | Dislike of SaaS isn't limited to monthly fees, but the lack
             | of features they removed to encourage SaaS adoption
        
               | musictubes wrote:
               | How many passwords are required if you aren't connecting
               | to the internet? What would you be signing in to?
        
               | LilBytes wrote:
               | After the initial login all your passwords are cached
               | locally anyway.
        
               | sooperserieous wrote:
               | Do you only keep online passwords in your manager? I've
               | got all sorts of things in mine, plenty that I might need
               | without connectivity, such as the door code to that
               | AirBnB or bank account numbers and PINs. Then again, I
               | never would have done that without offline
               | availability...
        
               | dylan604 wrote:
               | That's some low quality snark. I have plenty of local
               | things with passwords. One example is encrypted external
               | drives. That's all your snark gets from me on the off
               | chance it's not actually snark. (must me the most I've
               | used the word snark in one go)
        
       | Beijinger wrote:
       | enpass.io is great.
       | 
       | + Can't beat convenience.
       | 
       | + Cross platform
       | 
       | +/- free if you don't need mobile version
       | 
       | - Closed source
       | 
       | (no affiliation)
        
         | heinrich5991 wrote:
         | Bitwarden
         | 
         | + cross-platform
         | 
         | + free as in beer
         | 
         | + free and open-source software
         | 
         | Can't really comment on convenience, I moved from LastPass, but
         | it has worked well for me.
        
           | Beijinger wrote:
           | I think I checked this. The self hosted wallet was tricky if
           | I remember right.
        
             | lxgr wrote:
             | There's a Docker image that has worked out of the box for
             | me.
        
       | shironandon wrote:
       | this sounds great as long as law and federal enforcement agencies
       | can also access that password manager app as-needed.
        
         | favorited wrote:
         | End-to-end encrypted, so no.
         | 
         | https://support.apple.com/guide/security/icloud-keychain-sec...
        
       | ChrisArchitect wrote:
       | [dupe]
       | 
       | More discussion: https://news.ycombinator.com/item?id=40636292
        
       | sleepybrett wrote:
       | I hope there is a cli that will allow access to this like the
       | `security` command, maybe this is just another facade on top of
       | oldschool keychain?
        
       | epaulson wrote:
       | Are there APIs to get the iCloud sync into my own app? I'm all
       | for iCloud syncing to my devices I just want a way to also get a
       | backup in a file so if Apple decides to delete my account on a
       | whim, I don't lose everything.
        
         | musictubes wrote:
         | What account are you worried about Apple deleting? If they nuke
         | your iCloud account your info is still on the device.
        
       | daft_pink wrote:
       | I think it needs multiple domains for an account. It appears this
       | hasn't changed from their current setup from the screenshots in
       | the presentation.
       | 
       | I don't want to switch from 1pass if I can't set 2 or 3 separate
       | webdomains for an account as I find this to be the most annoying
       | feature of apple passwords, when a website has a separate
       | register page from it's login pages. In 1pass you can just delete
       | the subdomain and add domains. Apple doesn't allow you to edit at
       | all :(
        
       | m_a_g wrote:
       | I wasn't expecting this much hate towards 1Password in the
       | comments. I was using Google Passwords, then migrated to Apple,
       | finally to 1P7 and now 1P8. It's one of the best software I've
       | ever used and I don't know what I'd do without it. Same goes for
       | Fastmail as well.
        
         | dylan604 wrote:
         | you really enjoy paying each month for access to your
         | passwords? really?
        
           | max_ wrote:
           | One of the reasons for bad software products & corporations
           | taking advantage of users is this free loader mindset.
           | 
           | What exactly is wrong with paying $10 per year for a well
           | done product?
        
             | dylan604 wrote:
             | If it were $10, we might have a conversation.
             | 
             | I paid for my full version of 1Pass way back when, and
             | upgraded all the way through to v7. It was a one time fee
             | and used until they broke it.
             | 
             | I never said refused to pay for it, but a monthly fee in
             | perpetuity is just ridiculous to me.
        
               | max_ wrote:
               | I don't use. One pass, I use Bitwarden.
        
               | dylan604 wrote:
               | congratulations. this particular thread is about an app
               | called 1Password.
        
               | brailsafe wrote:
               | I'm still on v7, what did they break?
        
               | PascLeRasc wrote:
               | They disabled autofill in the Firefox/Chrome extensions
               | and won't provide an older version that worked or even a
               | download of the 1P7 app.
        
             | LVB wrote:
             | You get 1P for $10/year?
             | 
             | I'm willing to pay for a lot of software, but the costs are
             | certainly real (especially in aggregate), and I try to be
             | mindful of whether it is worth it to me. I would definitely
             | pay $10/year for a password manager. I currently pay
             | $36/year. Would I pay $100? No. But I'm not sure where the
             | cutoff is.
             | 
             | And then I have to do this for every pricier piece of
             | software. (For all of the lower-cost, one-time payments,
             | little apps, etc. I just pay and move on.)
        
           | JumpCrisscross wrote:
           | > _really enjoy paying each month for access to your
           | passwords?_
           | 
           | When it comes to a password manager, I appreciate having
           | constant access to updates. That isn't feasible for one-and-
           | done code.
           | 
           | That said, it's 1Password's bugginess that will have me
           | looking at Apple's offering. (Particularly how it performs on
           | non-Safari browsers, _e.g._ Orion and Firefox.)
        
           | short_sells_poo wrote:
           | Yeah. I want to pay the people who look after the thing that
           | stores my most precious information. I want them to be
           | overpaid and look after their golden goose.
           | 
           | It seems nuts to me that you expect someone to provide you a
           | service for free?
        
             | dylan604 wrote:
             | I never said free. Did I? Just because someone is revolting
             | against rent seeking companies vs building a solid product
             | and increasing users this forum likes to denigrate them
             | into being freeloaders. You've got the wrong idea and are
             | running with it in the wrong direction.
        
               | JumpCrisscross wrote:
               | > _vs building a solid product and increasing users this
               | forum likes to denigrate them into being freeloaders_
               | 
               | The point is maintenance is an ongoing expense.
               | Pretending it can be baked into a one-off purchase price
               | is nuts, unless one is willing to buy that software
               | _caveat emptor_ , as in if it has a critical bug, sorry,
               | you need to upgrade to have safe software.
               | 
               | For a game, that seems fine. For a password manager,
               | obviously not. That said, enough people don't like this
               | to give Apple an advantage in amortising payments that
               | users cannot.
        
               | dylan604 wrote:
               | Again with this made up concept that I wanted a pay once
               | notion. I kept upgrading with their releases until they
               | went SaaS and removed the ability to store the data
               | locally. If they continued to offer local storage with
               | paid upgrades, I'd continue paying and using. They don't,
               | so I'm not.
        
               | ivan_gammel wrote:
               | I just checked it on my device in airplane mode:
               | everything is available locally and new records can be
               | added. What do you mean saying you cannot store the data
               | locally?
        
               | dylan604 wrote:
               | with v8, there are no more local vaults stored on my
               | machine with other devices syncing via WLAN. it's all
               | cloud accounts or bust
        
           | eknkc wrote:
           | I do. It is a critical software for me. Why would I use
           | something inferior?
        
           | e40 wrote:
           | I used it with my family and it's worth paying monthly for
           | it. Passwords are so incredibly important. If I was hit by a
           | car tomorrow, I know a huge chunk of my life is there for
           | people to just pick up.
        
             | Marsymars wrote:
             | > If I was hit by a car tomorrow, I know a huge chunk of my
             | life is there for people to just pick up.
             | 
             | My wife and I have talked a bit about this recently but
             | haven't implemented anything yet. (I use 1Password, and she
             | doesn't have access other than a shared vault, and vice-
             | versa with iCloud passwords.)
             | 
             | One thing that gives me a bit of hesitation is from a
             | security standpoint - if we have access to each other's
             | accounts and one of us falls victim to, for instance, a
             | password-manager-level phishing scheme, the fallout from
             | both of us having to recover from that at the same time is
             | dramatically more of an inconvenience than if only one of
             | us is affected.
             | 
             | Happy to hear from anyone else who's thought about this and
             | any approaches they may have been taken - there doesn't
             | seem to be much discussion about it online.
        
               | e40 wrote:
               | The information in 1PW is the most important information
               | I have. I have a Yubikey because of that.
        
         | rickharrison wrote:
         | 1password has progressively gotten worse every year for the
         | past 5-10. 1password team if you are reading this, please stop
         | making your software worse. Search which was great for years is
         | now terrible and has jumbled results.
         | 
         | Some software should just be considered "done" and never
         | changed again. 1Password is one of those things.
        
           | fckgw wrote:
           | 1Password has gotten way, way better than it was a few years
           | ago in my opinion. Tons of new features and the redesign a
           | couple years ago was a big improvement.
        
             | jen20 wrote:
             | The electron rewrite was a significant step backwards
             | regardless of features and quality. I cannot wait to ditch
             | 1P.
        
               | e40 wrote:
               | How was it a step backward? I have noticed zero downsides
               | to 8 compared to the previous version. I'm comparing the
               | current version to the last version 7 I used. This
               | electron hate is such a headscratcher for me.
        
               | fourfour3 wrote:
               | I agree with this a lot.
               | 
               | I miss 1Password Mini in particular still (and no, Quick
               | Access is not a replacement).
        
           | pupppet wrote:
           | I dislike the new search so much, just make search work like
           | it does in every other application. If you're reinventing the
           | wheel for something so basic that's the first sign you're
           | doing something very wrong.
        
           | ivan_gammel wrote:
           | I don't really understand this kind of comments that complain
           | without any specifics. Worse how? I use two family
           | subscriptions and a corporate one for many years and haven't
           | noticed any regression in functionality or UX. They release
           | time to time minor quality of life improvements and continue
           | supporting modern platforms. 1P7 to 1P8 upgrade went without
           | any problems on all platforms I use. IMO this is the best
           | password manager on the market by many measures.
           | 
           | What is your experience exactly?
        
             | MrDarcy wrote:
             | For me, I paid full price for the app. I attached many
             | important documents such as my ID, SSN Card, my original
             | birth cert, even the deed to my house. If I pass my wife
             | knows where to get this info.
             | 
             | When my son was born I went to add his birth cert and SSN.
             | I couldn't. The "attach file" button is still there but it
             | simply doesn't work any more.
             | 
             | After hours of troubleshooting I finally found a discussion
             | on their own support form where they acknowledged they
             | explicitly disabled this feature. The solution is to switch
             | to a paid subscription.
             | 
             | I'll never buy software from them again. That's just one
             | example. They've removed similar functionality from cloud
             | sync services to compel users to buy a subscription.
        
               | maigret wrote:
               | Sad indeed but the days of 0 interest rates are gone.
               | Plus, software engineers in many countries are now
               | massively more expensive.
        
             | rickharrison wrote:
             | - 1Password used to support Dropbox syncing without a
             | subscription. They allowed you to keep using the app, but
             | they removed support for auto-filling logins from dropbox
             | in Safari or Firefox. You could only auto-fill from vaults
             | that you paid monthly for. Whatever, they win, I started
             | paying monthly.
             | 
             | - They broke search in the past few months. I have multiple
             | accounts with the same service (i.e. google, mercury) for
             | personal and business. Now when searching it displays
             | gibberish like 2FA backup codes from the notes instead of
             | just having `${title} - ${username}` like it had for years
             | 
             | - They completely changed the left bar and moved around the
             | entire UI multiple times. Credit cards used to be a simple
             | click on the left side. Now I have to click "All Items" on
             | the left side, then find the dropdown for "All Categories",
             | click it, scroll down to Credit Cards and click on that.
             | 
             | It really comes down to the fact that it's a password
             | manager. All it has to do is store passwords and fill them
             | in when I need to sign in somewhere. Why has the UI
             | fundamentally changed multiple times over the years
             | throwing away all learned user behavior.
             | 
             | EDIT: There's also just the intangibles. I can't always
             | remember specifics, but I "Feel" like 1password has been
             | fighting me for years. I don't feel that way about many
             | other pieces of software I use. 1Password just feels
             | hostile in how they change/update things.
        
           | e40 wrote:
           | I completely disagree. Yeah, the launch of 1PW8 was rocky.
           | They didn't have feature parity on some devices (iOS). I
           | waited a good while to update and when I did I had an issue
           | with my Yubikey, so I went back to 1PW7 on iOS, but it was
           | fantastic on macOS--way better than 7. After a short while,
           | they fixed the Yubikey login issue with 8 on iOS and I have
           | had exactly zero issues on macOS or iOS since, for about a
           | year(ish).
           | 
           | Another data point: my 85 year old mother used to have issues
           | with 7. She'd get confused about things. With 8, it's been
           | clear sailing for her. That's pretty impressive to me.
        
         | blawson wrote:
         | 1Password + Fastmail integration for generating masked email is
         | also great.
         | 
         | Plus a nice UI for handling OTP, notes, credit cards, IDs, bank
         | accounts, etc, it's easily worth the annual price for me.
        
           | squeegee_scream wrote:
           | Omg yes! Fastmail + 1P is soooo good. 1P has an integration
           | with privacy.com to create unique debit cards. With these 3
           | tools I have a unique email, pw, and debit card for each
           | service. Makes me feel in control over my interaction with a
           | service. Here's my referral link for privacy if you're
           | interested
           | 
           | https://privacy.com/join/JCPFN
        
         | sunshowers wrote:
         | Same, I'm actually a bit of a late adopter (only started using
         | 1p in earnest once they came out with a Linux client) but it's
         | been so great. I absolutely love the SSH agent in particular,
         | it just works.
         | 
         | On topic, as a primarily Linux user I'm not in the target
         | market for this (or any other Apple products or services
         | really) and that's fine.
        
         | tootie wrote:
         | We used 1pwd at my company and I have a paid family account. I
         | love it. Think it's worth every penny.
        
       | jftuga wrote:
       | I've been using KeePassXC on Mac and Windows and sync them
       | between each other with Unison[1]. I'd be curious to learn how
       | others who are using KeePassXC are syncing there databases with
       | iPhone.
       | 
       | [1]
       | https://gist.github.com/jftuga/0265e5403d56373662b9513d8816e...
        
         | lotsofpulp wrote:
         | Strongbox app and storing the database in iCloud Drive.
        
         | sngz wrote:
         | Proton drive and keepassx, keepass2android and keepass
        
         | sngz wrote:
         | Keepass2android and proton drive along with the keepass windows
         | app
        
         | lmz wrote:
         | Dropbox and KeePassium on the phone.
        
       | theogravity wrote:
       | Lack of Linux support and i'm not sure if it handles storing
       | files (eg pdfs) is what would hold me from adopting this.
       | 
       | I use 1pass across all platforms.
        
       | cletus wrote:
       | Here's Apple's big problem: it's not a replacement for so many
       | alternatives because it isn't supported on all platforms.
       | 
       | Safari? Not on Windows.
       | 
       | Apple Music? This actually has a Windows client. I'm not sure how
       | good it is. But Spotify supports Windows and even Linux.
       | 
       | Apple Password Manager? Will this be tied to iCloud? Will I be
       | able to use it on Android? If I no longer have an iPhone will it
       | be a pain to maintain and use?
       | 
       | A dog cannot serve two masters. A company like Apple doesn't see
       | any of these things as a product. They're a means to an end: to
       | push the iPhone platform (and hardware sales). That priority will
       | always trump the interests of a product like this.
       | 
       | It's also why I refuse to buy more into Google products: it's too
       | much of a risk to lose access to everything if Google wakes up
       | one day and decides to suspend your account with no recourse
       | other than making enough of a stink on social media such that an
       | employee will actually look into it.
       | 
       | People don't want everything tied to one identity, one service,
       | one login.
        
         | thisarticle wrote:
         | They're releasing an app for Windows that will solve that piece
         | at least. It'll sync across both.
        
           | cletus wrote:
           | In the same way I don't trust Google not to cancel whatever
           | it is they just announced, I don't trust apple to keep
           | supporting software on platforms that aren't theirs. They
           | just don't have a good track record and no real incentives.
           | The last widespread Apple sosftware on non-Apple platforms
           | was probably iTunes, which was terrible.
        
         | Someone wrote:
         | > Here's Apple's big problem: it's not a replacement for so
         | many alternatives because it isn't supported on all platforms.
         | 
         | I don't see why that would be a _big_ problem for _Apple_.
         | 
         | As this article explains, this isn't new functionality. It's
         | (mostly) a new UI for existing functionality, to make the
         | hardware they sell and make lots of money on more attractive.
        
           | quitit wrote:
           | Seems to be the case that commenters do not know that
           | Keychain Access exists.
           | 
           | Apple has tried various approaches of surfacing this
           | functionality (eg the passwords panel in Safari and again in
           | iOS's settings app). This just seems to be the app-agnostic
           | way of providing this functionality to everyday users, and
           | probably a good thing as platforms move away from passwords.
        
             | llamaimperative wrote:
             | No, Keychain Access is just a terrible app. It is
             | sufficiently terrible that I'm 100% aware of its existence
             | and instead choose to pay for a _less_ OS-integrated, but
             | far better app.
        
               | quitit wrote:
               | > No, bla bla irrelevant comment.
               | 
               | No, the commenters I'm referring to are ones that think
               | Apple including a password manager is anticompetitive
               | lock in, and other similar comments that are clearly
               | unaware that this is not new functionality.
               | 
               | Your comment has zero bearing on what I posted. Apple
               | themselves use 1PW
        
         | superb_dev wrote:
         | Apple Music has a decent web player, so it's technically
         | supported on Linux
        
         | fckgw wrote:
         | Apple already has an iCloud app for Windows and has had an
         | iCloud Password Chrome extension for years. There is no support
         | for Android.
        
           | lxgr wrote:
           | > has had an iCloud Password Chrome extension for years
           | 
           | Which is also only available for Windows, as far as I know.
        
         | ttul wrote:
         | If they haven't already, I won't be surprised if Apple creates
         | a reasonable password app for Android and Windows specifically
         | to address this concern. Fanning out to other platforms to
         | enable customers to continue using Apple products is a decent
         | strategy that probably does more to retain people within the
         | Apple ecosystem than it does to enable a move away from Apple.
        
           | jurmous wrote:
           | Apple already has a Windows iCloud password app and a Chrome
           | extension https://support.apple.com/guide/icloud-
           | windows/manage-passwo...
        
         | tootie wrote:
         | It's more platform lock-in and it leverages their market
         | position. Unabashed monopolism. Completely unchastened by
         | recent lawsuits.
        
           | kstrauser wrote:
           | Except for the fact that you can import from and export to
           | other password managers using built-in functions. That kind
           | of kills the whole lock-in vibe.
        
           | WheatMillington wrote:
           | Literally not a monopoly.
        
         | zitterbewegung wrote:
         | Apple wants it to be a problem so it incentivizes you to switch
         | over.
        
         | MrDarcy wrote:
         | I use Apple Music and Apple Notes every day on my Debian
         | workstation. Works like a charm.
        
         | basisword wrote:
         | >> People don't want everything tied to one identity, one
         | service, one login.
         | 
         | I think this is exactly what _most_ people want.
         | 
         | With password management specifically, Apple has had a Chrome
         | extension available for a while now which has allowed me to use
         | it on other browsers/platforms. Not ideal, but good enough for
         | most.
         | 
         | On top of that, they don't lock you in with passwords. You can
         | easily import and export your passwords, just like you can with
         | 1Password.
         | 
         | Apple Music has had a web client for a long time. iTunes has
         | been on Windows for 20+ years and Apple Music was supported via
         | that until recently when they built an Apple Music specific
         | app.
        
           | evilduck wrote:
           | Besides the web client,
           | 
           | https://cider.sh exists and is in various distro package
           | managers already too.
        
           | lxgr wrote:
           | > On top of that, they don't lock you in with passwords.
           | 
           | Now that many sites are moving to passkeys or TOTPs, it would
           | be great if Apple could not lock users in there as well.
           | 
           | > Apple has had a Chrome extension available for a while now
           | which has allowed me to use it on other browsers/platforms
           | 
           | That's only on Windows and requires you to install iCloud
           | tools locally, right?
        
         | WheatMillington wrote:
         | >People don't want everything tied to one identity, one
         | service, one login.
         | 
         | This is EXACTLY what people want. Please remember that HN is
         | not a cross section of the general public.
        
         | Izikiel43 wrote:
         | >> People don't want everything tied to one identity, one
         | service, one login.
         | 
         | Oh sweet summer child, HN is its own reality distortion field.
         | You don't want that, most people don't want to deal with the
         | hassle of it all, they just want to press a button and be done
         | with it.
         | 
         | FaceId/TouchId was a great leap forward in security because it
         | required barely any special interaction from the user, and it
         | reduces the friction for a bunch of things. Make it work for
         | anything (though this new password manager app)? Slam dunk.
        
           | BenFranklin100 wrote:
           | >> Oh sweet summer child
           | 
           | I only ever see this expression on nerd sites.
        
         | Justsignedup wrote:
         | Sadly this will take off, and be tied to everything apple. From
         | a tech perspective I would never use their tools even if they
         | are the most convenient. But the reality is most people will
         | see this as the only option for password management, and
         | 1password isn't free, so for them they will see no better way
         | out.
        
           | cletus wrote:
           | I would be happy if more people adopted password managers.
           | We'd all be a lot better off if they did. And personally I
           | don't care which tool they use to get there. But there's
           | still too much friction in using a password manager, not all
           | of which is the fault of the password manager (eg different
           | password requirements, how 2FA verification is handled, the
           | antiquated notion of password expiry, some sites split
           | username and password onto two pages so you have to verify
           | twice, some sites using a third field you have to fill in
           | like surname).
           | 
           | So I'm not sure how many people will actually use this just
           | because of this friction.
           | 
           | Branding a solution as Apple isn't a guarantee of success. If
           | it were, we'd still have Safari for Windows.
        
       | rdm_blackhole wrote:
       | I for one will stay away. What if your Apple account get banned?
       | Then you lose all your passwords?
       | 
       | It's the same reason I don't trust Google with all my picture or
       | documents. At any point in time their algos can flag your account
       | for wrong reasons and that's the end of your digital life.
        
       | BiteCode_dev wrote:
       | A password manager that doesn't have an open-source client cannot
       | be truely checked. Therefore it cannot be trusted to encrypt them
       | before being sent nor to not contain a backdoor.
       | 
       | Apple was part of the PRISM program, we know they gave access to
       | our data for mass spying.
        
       | vbezhenar wrote:
       | Good. I already switched to iCloud Passwords for all my needs,
       | but it's not very convenient now. No way to store bank card info,
       | no way to store ssh passwords (I'm using fake domain
       | myserver.ssh.com, but that's weird), no way to store key files.
       | Hopefully it'll get better.
        
       | PlunderBunny wrote:
       | I've never understood why there are some passwords that exist in
       | the macOS keychain app that don't appear in the Passwords section
       | of the macOS System Settings (I think the password for my WiFi
       | hotspot is one of them). Can anyone explain this? Will the new
       | Password app have 'everything' in it?
       | 
       | I always end up looking in the Keychain app to be sure to find
       | what I'm looking for, but I dislike that app because it often
       | takes several password entries to get to see a password.
        
       | Angostura wrote:
       | So they are reinventing the KeyChain Access app on MacOS?
        
       | offsky wrote:
       | If I lose access to my Apple account (via hacking, being banned
       | or otherwise), do I also lose access to all my saved password?
       | Thats what I want to know.
        
         | musictubes wrote:
         | No.
         | 
         | Passwords are saved on your device.
        
       | sam_goody wrote:
       | Maybe I don't want "whoever" to be able to get into every one of
       | my accounts by coercing Apple to give access to all my passwords.
       | 
       | There are groups that can do that coercion (eg. US and CPC
       | governments), and there _may_ be support staff et all in Apple
       | that can get the same access.
       | 
       | For the same reason, I was unhappy that Keychain.app is auto
       | synced to iCloud (and as per a past thread, even if you disabled
       | it it may be reset).
       | 
       | So, of course, I don't have to use their app. Except that I
       | suspect it will be built into the OS in a way that makes it hard
       | to avoid, such as Keychain.
       | 
       | I would love it if there was a way I could setup my self-hosted
       | BitWarden instance to be as integrated as Keychain is, and not
       | use Apple or Google for passwords.
        
       | jljljl wrote:
       | I want to use this, but this post gave me pause:
       | 
       | https://x.com/blader/status/1800263787746066646
       | 
       | "apple sherlocked 1Password today, so i'd like to remind you that
       | your Apple ID is only as secure as your carrier.
       | 
       | if you have 2FA on and get SIM swapped, attackers can lock you
       | out of it PERMANENTLY.
       | 
       | last month it happened to me. make sure it doesn't happen to you:
       | "
       | 
       | Getting locked out of all my passwords would be pretty
       | disastrous. Did Apple announce a change to the account lockout
       | procedure as well?
        
       | adam_arthur wrote:
       | People should just use a sufficiently complex, memorized,
       | password for their money/identity, and then a (mental) algorithm
       | that allows deriving unique passwords for other services that are
       | less important.
       | 
       | Only have to memorize 2-3 strings and more secure than a password
       | manager since there's no third party in the loop.
       | 
       | Password Managers are a huge man-in-the-middle and liability in
       | other regards (e.g. you don't have it present on a given device
       | or on hand).
       | 
       | SSO from a single set of credentials is a much better solution.
       | Multi-factor biometrics even better (outside of PII
       | sensitivities)
        
       | diebeforei485 wrote:
       | 1Password has gotten progressively worse. It's now an Electron
       | app (so it's slower to load), and some features have stopped
       | working well.
       | 
       | They took VC funding to pivot to enterprise, anticipating that OS
       | vendors would integrate basic password management features (what
       | most of their usage at the time) into the OS.
       | 
       | So the consumer experience has been de-prioritized. I will not be
       | renewing my 1Password subscription.
        
       | thway15269037 wrote:
       | Are they going to remove competitor password manager apps as they
       | did with other things they have incorporated into the iOS?
        
       ___________________________________________________________________
       (page generated 2024-06-10 23:02 UTC)