6 ms·

thats how cloud stored password managers work..

a2128 2y ago
Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no
- stouset 2y ago
  If you don’t want it, don’t store your passwords in it?
  - SoftTalker 2y ago
    Yep. Disabling password storage is one of the first things I do when setting up a browser on a new computer.
- acdha 2y ago
  A decade ago this was more true but all of the major browsers include a cloud password manager now, and this is very popular with normal people because it means a lost or failed device doesn’t mean they have to go through a bunch of password resets. The big question here is whether there’s a reproducible way that the opt-in changes. iCloud Keychain has robust end to end encryption but it still needs to inform the user.
coldtea 2y ago
They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!
- gruez 2y ago
  >They offer no option to delete your passwords from the Cloud once there? Seems pretty trivial to download the icloud windows client (which has password manager support), and modify/delete the passwords there?
- nicce 2y ago
  > They offer no option to delete your passwords from the Cloud once there? Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks. That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?
  - stouset 2y ago
    Your passwords are encrypted with keys stored only in the local on-device TPM. This is a pretty lame windmill to tilt at.
    - krageon 2y ago
      The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.
      - Retric 2y ago
        Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything. They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.
        Sindisil 2y ago
        Indeed, companies are not people. Compare the consequences for a large company vs an individual. For the individual, if caught, a debilitating fine and, depending upon damages, jail time. Probable end of career, if related. In short, life changing. For the company, possible fine almost certainly less than the revenue made. Small chance of larger civil suits, with legal costs and possible judgments. Depending upon visibility, perhaps some additional PR spend. Even if the sum total cost is greater than the associated revenue, those costs can be used to offset tax liability. In short, low risk of existential threat, or even actual financial loss -- just reduced profits.
- threeseed 2y ago
  You just open Keychain/Passwords and delete the passwords. Has been this way for at least a decade.
  - lapcat 2y ago
    > You just open Keychain/Passwords and delete the passwords. This also deletes the local copy of the passwords.
    - threeseed 2y ago
      There is a separate iCloud Keychain so you can just copy to your local one. Or use the Export All Passwords feature in the Passwords app.
      - lapcat 2y ago
        > There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't want them in iCloud.
        tonyedgecombe 2y ago
        >I want to use the operating system to store my passwords locally. I just don't want them in iCloud. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac
        lapcat 2y ago
        Your copy-and-pasted reply is as wrong here as it was there: https://news.ycombinator.com/item?id=42016863 https://news.ycombinator.com/item?id=42016863
        2y ago
hello0904 2y ago
Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).
- nicce 2y ago
  The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.
  - hello0904 2y ago
    Agreed. But we are talking encryption and why there isn't open source algorithms for iCloud. I find it funny as when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" but at the same time all their crypto is a black box. I'm a happy Apple user, love the OS...just saying.
    - lapcat 2y ago
      > when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" This is not true.
- chrisBob 2y ago
  > Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. That is true if you are running a service that USES passwords. In that case you just need to confirm they match. That is not true if you are running a password manager where the user needs to be able to get their plain text password back out of the system.
- threeseed 2y ago

Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no

stouset 2y ago
If you don’t want it, don’t store your passwords in it?
- SoftTalker 2y ago
  Yep. Disabling password storage is one of the first things I do when setting up a browser on a new computer.
acdha 2y ago
A decade ago this was more true but all of the major browsers include a cloud password manager now, and this is very popular with normal people because it means a lost or failed device doesn’t mean they have to go through a bunch of password resets. The big question here is whether there’s a reproducible way that the opt-in changes. iCloud Keychain has robust end to end encryption but it still needs to inform the user.

coldtea 2y ago

They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!

gruez 2y ago
>They offer no option to delete your passwords from the Cloud once there? Seems pretty trivial to download the icloud windows client (which has password manager support), and modify/delete the passwords there?
nicce 2y ago
> They offer no option to delete your passwords from the Cloud once there? Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks. That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?
- stouset 2y ago
  Your passwords are encrypted with keys stored only in the local on-device TPM. This is a pretty lame windmill to tilt at.
  - krageon 2y ago
    The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.
    - Retric 2y ago
      Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything. They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.
      - Sindisil 2y ago
        Indeed, companies are not people. Compare the consequences for a large company vs an individual. For the individual, if caught, a debilitating fine and, depending upon damages, jail time. Probable end of career, if related. In short, life changing. For the company, possible fine almost certainly less than the revenue made. Small chance of larger civil suits, with legal costs and possible judgments. Depending upon visibility, perhaps some additional PR spend. Even if the sum total cost is greater than the associated revenue, those costs can be used to offset tax liability. In short, low risk of existential threat, or even actual financial loss -- just reduced profits.
threeseed 2y ago
You just open Keychain/Passwords and delete the passwords. Has been this way for at least a decade.
- lapcat 2y ago
  > You just open Keychain/Passwords and delete the passwords. This also deletes the local copy of the passwords.
  - threeseed 2y ago
    There is a separate iCloud Keychain so you can just copy to your local one. Or use the Export All Passwords feature in the Passwords app.
    - lapcat 2y ago
      > There is a separate iCloud Keychain No, there is not. If there was a separate iCloud Keychain, then my passwords never would have gotten uploaded in the first place. Most of these passwords were Safari web form logins. Safari stores them where it wants. > Or use the Export All Passwords feature in the Passwords app. Export them to where? I want to use the operating system to store my passwords locally. I just don't want them in iCloud.
      - tonyedgecombe 2y ago
        >I want to use the operating system to store my passwords locally. I just don't want them in iCloud. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac
        lapcat 2y ago
        Your copy-and-pasted reply is as wrong here as it was there: https://news.ycombinator.com/item?id=42016863 https://news.ycombinator.com/item?id=42016863
      - 2y ago

hello0904 2y ago

Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).

nicce 2y ago
The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.
- hello0904 2y ago
  Agreed. But we are talking encryption and why there isn't open source algorithms for iCloud. I find it funny as when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" but at the same time all their crypto is a black box. I'm a happy Apple user, love the OS...just saying.
  - lapcat 2y ago
    > when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" This is not true.
chrisBob 2y ago
> Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. That is true if you are running a service that USES passwords. In that case you just need to confirm they match. That is not true if you are running a password manager where the user needs to be able to get their plain text password back out of the system.
threeseed 2y ago