There’s a long running ticket to do this on OS X which started out as NIH/apathy but gained a good reason not to as Apple restricted iCloud password support to App Store applications.

https://bugzilla.mozilla.org/show_bug.cgi?id=152485

That ticket is marked as resolved and the last update is 16 years ago.

Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I just checked the documentation for kSecAttrSynchronizable and there's no mention whatsoever of it being restricted to App Store apps.

Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone.

The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support:

https://bugs.chromium.org/p/chromium/issues/detail?id=466638

Thanks.

It sounds like the real problem here is the fact that iCloud keychain doesn't have an access control list so apps can only access items within their same App Group, which means Firefox can't see Safari passwords and, if Firefox switches to iCloud keychain, no other browser can read passwords from Firefox. Though honestly this doesn't sound like a big deal to me (especially since the "Firefox can't see Safari passwords" is already the situation).

The Chrome bug does claim that Mac apps could not use the keychain access groups entitlement without being in the App Store but I can't find any hint of that being true today. I believe Apple relaxed the iCloud restrictions at some point so it's possible that this used to be true and isn't anymore.

It mostly annoys me that we had at least 17 years where this relatively modest amount of code would have made a big security & usability benefit. Even if Apple eventually deprecated it, that’s a longer useful lifespan than an awful lot of code has.

Afaik, Chrome(ium) no longer has support for the Mac keychain and uses some kind of mechanism of its own :/

It doesn't help. All the passwords can be enumerated using the OS API.

It would actually be a lot easier to gather passwords if all applications used the OS store.

But you still need to unlock the keychain to get those... so what’s the difference?

If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.

> If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.

I don't know about Macs but PCs have a Smart-Card like Chip called TPM build in for about 20 years by now.

One of the main functions a TPM offers is the secure storage of encryption keys.

I wonder such a feature comes only now to Macs with about two decades of a delay?

I mean, TPMs only started appearing in laptops in the mid 2000s, but whatever. Unlike the TPM on most non-Apple laptops I've bought recently, the OSX secure enclave does significantly impact the security of the system. I don't know why Apple decided to create their own instead of using the standard TPM, but they've done a pretty good job of using it, unlike most other hardware vendors.

Not correct. Unless you're specifically talking about some stuff by Apple.

Do you know that windows has had password stores for many decades?

Which part was not correct? macOS does indeed have, and has long had, a keychain API, if that’s the part you’re thinking of.

As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).

This can't be the explanation, since Chrome manages to sync passwords between devices.

Are you sure that Chrome uses keyring?