Password managers vs Keychain
Apple’s own solution for password management is Keychain Access for the Mac, which adds cross-device syncing with the introduction of iCloud Keychain, making it highly convenient for the user to generate and/or save one password on an iOS device and have it automatically recalled on a Mac when needed.
The feature only works with Apple’s native web browser, Safari, so if you prefer Firefox or Google Chrome then you are out of luck. Apple also has a native app for storing notes, and if the user encrypts the SSD or HDD of the Mac using FileVault, then he or she will have full protection of their data.
Having access to all that data, however, is not possible, because the user still needs to launch the Safari app to view the passwords and saved credit card data, or the Notes app to view the stored notes. Password management apps, by comparison, store all the data in one place – passwords, secure notes, credit card details, or whatever – all kept in the cloud, encrypted and accessible to the user as soon as he or she types in the master password.
In addition, password manager services are usually available on all major platforms, whether desktop or mobile, so users won’t be locked into the Apple ecosystem and can take advantage of other platforms that they might use.
Mac and iOS password manager
Having immediate access to all your passwords on both Mac and iOS devices wasn’t easy before cloud-based syncing came into the picture, since users had to type in and save the credentials separately. As cloud-based services such as Dropbox and iCloud became more widespread, password managers like 1Password added these tools into their apps to enable cross-device syncing.
Before then each device had its own locally-stored vault, accessible by the user on that specific device only. To share data across their other devices, users had to find a way to sync it effectively. 1Password users did this by either setting up a WLAN server – to ensure the data didn’t leave the local network – or by keeping a copy of the standalone vault in a folder. They then had to configure the preferred syncing solution to keep it up-to-date with other Macs or iOS handsets.
This all changed with iCloud Keychain and cloud-based password management services. Fortunately, nowadays all password managers provide secure cross-platform syncing, making it easier to access sensitive data on all used devices.
Password security on the Mac
Despite the recent rise in attacks targeting Mac users, macOS still remains one of the most secure operating systems. Still, the security of your Mac depends primarily on how well you secure passwords, especially in certain key areas.
The first level of security is the login or user password, which gives users a certain level of access on the Mac – with administrator users have different privileges than standard user accounts.
The Common Vulnerabilities and Exposures (CVE) database notes a handful of security vulnerabilities that iCloud Keychain has faced and Apple has subsequently patched. The most recent iCloud Keychain security flaw allowed man-in-the-middle attackers to bypass an iCloud Keychain secret protection mechanism by leveraging a lack of authentication required for OTR packets. Apple confirmed and patched this flaw with a software update and credited Alex Radocea of Longterm Security, Inc. for discovering it.
In the end, it all comes down to trust, and Apple’s communication on the matter emphasizes its efforts to continue to earn the trust of the millions of users the company serves via its mobile platform and macOS. To address potential security vulnerabilities, Apple has launched a bug bounty program, although that still needs some work to make it more attractive to security researchers considering that a zero-day iOS flaw could sell for more than a million dollars.
István F.
Adam B.
User feedback