Hacker News Reader

Comment by bognition | Hacker News Reader

Honestly it may sound stupid but the native integration with password managers is a killer feature. I've trained my family to use 1Password and the biggest pain point was filling in passwords on the iPhone.

iOS 12 completely fixes this issue.

View on HN

Also 2FA via text now works. Not the most secure solution, but it's cool to see improvements in usability.

anyone offering 2fa via SMS without any other possibility needs to be named and shamed.

Instagram

any bank

etc

It's better than not having it at all, I would think.

That depends. If you're a sufficiently valuable target, it's actively worse, because it creates a false sense of security.

I disagree that it's worse. I have SMS on some of my accounts.

I am aware of the risks, but it's inherently better than nothing at all.

I have yet to see how SMS / Mobile Phone account can be hijacked in places where getting a new SIM card requires some form of ID. So SMS being unsafe for 2FA is mostly (?) a problem in US and some part of EU.

Does this explain it well enough? https://arstechnica.com/information-technology/2017/05/thiev...

If I know your phone number I can get your 2fa code. It a security HOLE.

Instagram accounts get swiped all the time. There is a vibrant account trading economy on IG, and there are no reassurances that the account won't get swiped back.

Facebook knows how to do to 2fa without SMS, but they want everyone's phone numbers and social graph too much.

Account trading lives in the shadows and it won't have a favorable public view, therefore the problems inherent to the platform itself don't get attention right now.

Putting Facebook on blast is the way to change this.

the only reason its not worse is because nobody's leaked a phone number database yet with accuracy regarding who is using it for 2fa. Currently strangers can't look at a list of phone numbers and tell if they are used with Instagram or Facebook and if that account is even valuable, quickly.

just security through obscurity.

It's not stupid, that's why android already has it ;)

I was going to comment on how is it possible to still have features from one OS not yet implemented in the other (because let's be honest it goes in both directions)

Autofill was an Oreo feature, so it checks out, Apple added it as well in the next release.

(Autofill as a feature has been there for way longer on Android but it was relying on accessibility, which was a bit hacky and pretty unsecure)

Most Android phones will never see it. I replaced my Moto G3 with a 6S Plus in part because I was tired of the lack of care from the manufacturers once the payment cleared.

I replaced the Android before it for the exact same reason. Motorola developed a good reputation, which was promptly torpedoed once it got bought.

>Most Android phones will never see it

I am pretty that most of the Android phones will be sold in the future ;)

Even without being cheeky, I believe that most of autofill is supported through play services on older phones

> I replaced my Moto G3 with a 6S Plus

I have plenty of issues with Motorola (and the Android OS update situation) but you bought a budget $250 phone. Not particularly surprising that the customer care and updates etc. weren't on par with a phone that retailed for 3 times that.

The Autofill API is an Oreo feature but password apps can draw over others and fill forms without it so it has worked on Android for years. It was one feature which meant I would never consider an iOS device, so good to see it implemented.

iOS had integration with 1Password before but it was slightly clunky and required a couple taps to get there.

I do like that each platform tends to stay up with the other for the most part, adopting the good ideas. I switched to iPhone to get the native call blocking API, which I believe in the next release Android adopted as well.

Based on the review, it looks like the iOS 12 password manager has matured quite a bit, but it doesn't say anything about integration with an external password manager. How have things changed for 1Password users?

You can now autofill passwords from a 3rd party password manager via a native api integrating with the OS keyboard.

Source: https://twitter.com/rmondello/status/1041737681141587968?s=2...

Wow, thank you so much!! I totally missed this. This was so badly needed.

No mention of KeePass, which is a shame

It's an api (https://developer.apple.com/documentation/authenticationserv...) so KeePass just needs to do the work.

KyPass 4 works. Costs $7, but I was fine with that.

Does KyPass autofill? I've been using MiniKeePass for years but would be happy to pay for autofill support. It would also be nice if it kept a persistent connection to my Dropbox database, eliminating the need to update it periodically.

1Password shows up on the keyboard just like the native password manager. It's an API that you can allow 1Pass to use.

If you want to try it out, remember to update the 1Password app first. Took a good 10 minutes this morning of "wtf, why can't I select another password manager" before it dawned on me.

More detail here: https://www.macstories.net/stories/ios-12-the-macstories-rev...

Are there any reason to use 3rd Party Password Manager now iOS12 has everything built in ?

I am wondering what sort of uses cases am I missing, assuming everything I use is inside Apple's ecosystem.

Synchronizing with desktops - particularly non-OSX desktops.

Wait, I must have missed this feature after I updated. Is it now connected with my 1Password? Or do I have to set it in the settings or something? I'm only seeing the autofill icloud password stuff.

It's hidden kinda deep in the settings...

Settings -> Passwords & Accounts -> AutoFill Passwords then check 1Password.

Ahh found out the problem. I had to update 1Password in the app store for it to show in there! Thanks!

Reply on news.ycombinator.com