Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Why Apple's Passwords app is huge security risk
- Thread starter Jtte
- Start date
-
- Tags
- passwords app security
- Sort by reaction score
The bigger issue nowadays is that we have so many passwords. So even if you have a phrase that’s hard to crack, if one of your many passwords is broken the social engineering tricks hackers have will get them into everything else. As humans are unlikely to have that many unrelated passwords.I follow the XKCD route of making my passwords easily remembered short phrases. Also use 2FA for most everything.
Which is why the computer generated ones work best because there will be zero relationship between any of your passwords from a social engineering point of view.
I also think that nowadays with AI I guess your social graph could be used to infer variations of phrases that you are more likely to use as passwords. So again going forward I think generated passwords on the whole seem safer.
I follow the XKCD route of making my passwords easily remembered short phrases. Also use 2FA for most everything.
Memorable passwords wouldn’t help me if I have a few hundred different ones. I would not remember the memorable passwords I chose - especially since most are used infrequently.
Two factor is a great extra step. It’s a bit less effective if the cracked password program is used as the authenticator app to generate one-time codes. Another thing that weakens it is if you allow a site to remember your device as trusted and not require 2FA in the future. Finally, SMS 2FA won’t help if the compromised device is set up to receive text messages. I’m embarrassed to admit that, even though I use 2FA, all of these things impact me.
If I’m not mistaken, Schwab’s only 2FA approach is to record approved devices. The compromised device might be the second factor. That one impacts me too.
Good points.
Using my stupid brain, a memorable password is not memorable once it's not in regular use.
One thing that I've seen recommended when it's suggested to use memorable passwords is to make sure that the words used are chosen randomly, either by software (1Password can randomly generate memorable passwords) or some other technique (e.g. rolling dice).
Here are two random passwords of the complexity that I usually use:
units-retract-larissa-runner - if I might have to type it somewhere (e.g. using a TV remote) or share it verbally with someone
6C.VpCHMfr*J@BVWP@Um - otherwise
I have no evidence of this, but I feel the second one is more secure in the face of future cracking advancements.
I was mistaken about Schwab. I can set up SMS, mobile device authenticator, Symantec VIP app, or physical token. I guess it's better to be wrong than right since you can learn something. Nah, I'd rather be right.
2FA doesn't really help anything in this case. If a bad guy knows the password to your Mac account, they can go in and view/use/export your passwords from the Passwords app.
Sure, maybe all those accounts/passwords are then using 2FA, but still...the bad guy could potentially verify by email if the account is already set up in Mail, or even by text in the Messages app if the owner has text message forwarding set up on their iPhone. (Ever say you don't have your phone with you to verify, or need to reset 2FA? Email or text is usually the next option.)
But yeah, all this can be avoided by not giving out your password and by wiping the Mac if you're taking it somewhere to be repaired.
Last edited:
The nice thing about 2FA is that it handles what I think is the biggest risk. Someone has your computer and login credentials, copies your passwords to a thumb drive, then gives the computer back to you. Not every bad actor has the luxury of doing the dirty work on the job, where their activities could be observed.
To sum it up, it still is a big security risk to use Apple Passwords and it is better to use some good 3rd party Password Manager.
1Password, Bitwarden and maybe the best 'Strongbox' because it does support native macOS password management system?!
1Password, Bitwarden and maybe the best 'Strongbox' because it does support native macOS password management system?!
I've had a logic board die on my MacBook Pro -- so no way I could "prep it" before taking it in for repair.
Some are responding to this thread saying that there is no issue because a user doesn't have to give Apple their login password when bringing it in for hardware repair. These responses seem off-topic since the OP's post didn't even raise Apple's hardware support as one of the dangers with Apple Password.
Some are responding as if this thread is a poll - "Is Apple Password's approach a risk to you?". The OP's post was about risks to users at large who are in various situations. Discipline is a way to work around some of the risks, but that is no solution to the problem since most people don't have discipline.
Some are responding as if this thread is a poll - "Is Apple Password's approach a risk to you?". The OP's post was about risks to users at large who are in various situations. Discipline is a way to work around some of the risks, but that is no solution to the problem since most people don't have discipline.
Same. My approach is: (1) Unique, randomly generated passwords for everything, (2) stored in 1Password and a strong and unique account password for 1Password (plus, ideally, a security key for 2FA to 1Password), and (3) regular encrypted exports/backups of the 1Password vaults.
It is worth noting that, by default, Time Machine backups would include 1Password vaults stored on the Mac. So if something bad happened with 1Password, one could always roll back to an earlier version of 1Password and the earlier version 1Password vaults. (I believe the same would be true with local backups of any iPhone/iPad using 1Password.)
I can tell one thing why Apple Password is a problem that might pose a risk - it is making random bubble-style popups prompting for touch ID or your account password complaining "Passwords is locked". It is impossible to understand what application is triggering these and where is the form/fields data from Passwords is wanted to.
I have it happening after updating to 15.3, but I am able to find older references to this problems in internet as well.
It makes a serious security risk if it is impossible to understand where your credentials will go after unlocking Passwords in response to these popup bubbles.
I have it happening after updating to 15.3, but I am able to find older references to this problems in internet as well.
It makes a serious security risk if it is impossible to understand where your credentials will go after unlocking Passwords in response to these popup bubbles.