Hacker News Reader

Comment by waxjar | Hacker News Reader

An iCloud keychain? No thanks.

The average non-technical user is going to be far better off with that than the current state of "password1!" used on every site across the internet.

The average non-technical user will now have "password1!" synced with iCloud.

It automatically suggests new passwords based on Random strings when it sees a password box.

The average user already has created most of the accounts she will create. Outside of HN not everyone is trying out new services everyday. I could also see many people being confused by a random password and think to themselves that they'll never remember it and then override to use their trusty [but] insecure password. It's also not cross platform so not a solution for many people.

It's not Apple's fault, I'm sure it's a great password manager. The problem is passwords are broken. Managers are a good band aid, but fundamentally passwords are broken.

What would a better solution look like?

Yes, announcing that right after PRISM is leaked may not be the best idea. :)

The last side basically says: "encrypted client side".

Well, HN has told me that the NSA is all-powerful, so I'll take that with a grain of cyber-salt. /s

Edit: Non-sarcastically, but what about the metadata about the keys?

like the position of the keys on the keyboard you pressed when you typed your password? it's meta-data ;)

Isn't the keychain encrypted client side though?

How do we know they aren't holding our private key in escrow?

How about we hold off on leaping to conclusions before we see how it works?

I'm not leaping to any conclusions. I think my question is totally fair. Is Apple providing the source code to this system so that we can audit it? Or do we just have to trust one of the companies implicated in the PRISM scandal?

LastPass does this really well for all devices, works with any browser, even mobile too!

This iCloud key chain must be Safari only! :)

I thought they'll add KeyChain integration in iOS more deeply. Something like, "If you tap-hold on a password field in an iOS app, the OS will ask you if you want to paste the password from your KeyChain." That's where it becomes much more useful than LastPass.

Just wish I could use it more easily on ios. The lastpass app is OK, and the bookmarklet is meh.

FireFox already interfaces with the normal KeyChain. Why must it be Safari only?

I will be interested in seeing how well this works, given what a pig's breakfast the old .Mac keychain syncing was.

Funny, I thought "at last!" 1Password is fine, but I'd prefer a more integrated experience.

The idea an sich is good. In light of last week's news however, I'll stick with 1Password.

Reply on news.ycombinator.com