7 ms·
It is a fair observation. And I can see why users tend to be alarmed about this. Although in my experience users tend to significantly underestimate the real ri
by skarra 3y ago
It is a fair observation. And I can see why users tend to be alarmed about this. Although in my experience users tend to significantly underestimate the real risks of online attacks relative to these more visceral threats.
Let met ask you: has that discovery made you stop using your iPhone, or storing passwords or other critical data in your iCloud? If the answer is "No", then you're strictly better off moving to passkeys stored on iCloud as well.
- lxgr 3y ago> Let met ask you: has that discovery made you stop using your iPhone, or storing passwords or other critical data in your iCloud? Yes, it has (the latter). I was a big fan of (non-synchronized) on-device passkeys, but this has significantly changed the threat model for me. I use a third-party password manager exclusively now, and I'll probably be using its synchronized Passkey implementation too if it turns out to be any good. As soon as Apple starts offering a different set of security trade-offs (e.g. make usage of the recovery key mandatory when resetting my iCloud password, or at least implement a timed lockout), I'd gladly start using iCloud Passkeys and maybe also its password manager.
- konschubert 3y agoI think you can set a longer iPhone password instead of a pin. Harder to surf.
- lxgr 3y agoSure, but that's really inconvenient in the 99.9% of cases where I just want to unlock my phone, not recover my iCloud account password.