Hacker News Reader

Comment by pseudosavant | Hacker News Reader

"Download iCloud for Windows to use iCloud Passwords"... On Windows this requires 'iCloud for Windows'. A definite non-starter for me. There is no reason to have an extension like this call out to locally installed software for a cloud service like password management. I'm sure it can be done in JS/TS/Wasm within the context of an extension (doesn't have same-origin issue).

View on HN

AFAIK in web TS/JS/Wasm you cannot mark memory regions as in-memory only (mlock on Linux). This means that the secrets in JavaScript can easily be leaked if the kernel decides to page V8 process memory (unencrypted) to disk.

This risk is unsuitable for an application that needs to handle sensitive credentials like an encryption key for all of a person’s passwords — or the vault itself.

Also, this is why I do not trust LastPass — they don’t run a native module, so how do I know that my vault isn’t just being stored on disk?

I don't know the internals, so I'm guessing, but for password sync between iCloud devices Apple might require a hardware protected key (like in a TPM). In which case it does make sense that this requires a native process running on the host. At least until that can be exposed in a meaningful way through a Web API. I doubt it's as simple as querying the iCloud servers for the plaintext password.

Pretty sure 1Password has the same constraint. Lastpass did not but well... they dont have the best reputation anymore.

Reply on news.ycombinator.com