Hacker News Reader

Comment by Toutouxc | Hacker News Reader

What does everyone think about just using Apple's Keychain for everything? Seems that for Keychain the most serious threat is actually being rando-banned by Apple and losing access to my stuff.

View on HN

I honestly don't want to be locked out of my passwords, just because Apple decides to block my account for "abuse", because I use iTunes Music Fitness Plus from wrong country or whatever.

There are all these "lol we blocked you for abuse, good luck doing anything :^) I guess complain on twitter lol" horror stories that I don't want to be locked down to one provider that does _everything_, the way Google or Apple does.

Even the fact that I have all e-mail at Google that can randomly ban me for "abuse" makes me scared, but I don't want to figure out how to move all my mail history to ProtonMail or AOL or whatever. I will need to have that as a risk.

I think we seriously need legal regulation for that. A company should not be able to take your personal data hostage like that. If they really want to ban you, you should at least be able to legally request a copy of all your data.

The Apple Keychain items are stored locally in ~/Library/Keychains

This is true. Apple can't lock you out of your keychain. You can register with them to have an unlock key, but that is different.

For me, I find the Keychain to be too chaotic. I use 1Password.

I moved to Protonmail for precisely this anxiety, and can tell you that there's not much to "figure out". It's pretty painless, they have a guide for it, and despite what I think about Google, their "Take Out" service isn't too bad.

This is what I have been doing since migrating away from LastPass. It has been great so far (and free). I’d say that I wish I could share passwords like in LastPass/1Pass but honestly my wife always struggled with that, so it’s easier to just AirDrop a credential if we need to share. It’s also integrated so well with Apple products that my wife was using it without even realizing it. I suspect the same will happen with my daughters.

If you’re an Apple house, it’s a great solution.

One would have to exist solely in the Apple ecosystem for this to be viable, surely? Surely most people on HN have at least one device that isn't Apple!

Yes, it's only convenient on Apple devices. But it's still doable if you don't access that much stuff on other devices, e.g. when I need to access something on my Windows computer (which basically exists to run Microsoft Flight Simulator), I just manually retype passwords from my iPad.

There's a Windows app for iCloud to show passwords, but it's very basic.

I tried this app, I thought it was very elementary and a very sub-par experience for myself as the user. I would not recommend.

For Google Chrome only.

I use a mix of Keychain and MacPass (keepass compatible). I will add something to MacPass, then sign in with it and let Keychain remember it. Notes however:

1. I do not use the MFA capability of Keychain at all. Putting your MFA, username and password in the same store is fucking stupid. I have a hardware TOTP token. Backup codes for that are however kept in Keepass.

2. I keep an offline backup of everything. Never trust a cloud backup!

3. All vendors are ephemeral, regardless of their size. Everything I have I have a carefully planned exit plan for.

As other people have pointed out, your keychain is on disk, but if you lose the Mac and find out your MFA codes don't work or something (this does happen) then you're SOL. Keep a backup.

I'm not sure about apple's cloud stuff, but the keychain is an actual just a file on your system. It is password protected, but it is just your login/sudo password (depending on which file it is).

I just had my keychain corrupt last night while I was testing the SecItemAdd API. So keep that in mind, maybe make backups. I was pretty shocked that you can corrupt the keychain using just the API, the entire security process started to lock up too. I had to (manually!) delete the entire keystone and start from scratch. Luckily I don't rely on it much.

It is worth noting that after you back it up to a remote location, it may not be a very secure concept anymore.

Keychain is perfectly fine if you're all in on Apple stuff. I am, so I could start using it today. A downside is that it doesn't have much in the way of a dedicated UI, especially on iPad/iPhone. Compare the 1Password app to Settings > Passwords on a phone. Keychain also only handles passwords, and not TOTP, notes, software licenses, etc.

You can export your keychain and import into other password managers, if you have access to a Mac. I doubt this can be automated, though, and passkeys will need another solution.

Reply on news.ycombinator.com