> Yeah, this is super fucking weird. You'd think this would be connected in some fashion to "keychain", but nope.

Other browsers used to be able to use it. I do think it’s a really thorny issue—“allow this application to access all saved passwords?” is a pretty damn scary permission to include. Up there with the “allow this application to control your computer” permission that is used for accessibility apps (which apps can abuse to read passwords, if I understand correctly).

Apple’s tradition. Make the platform more secure, add an exception for first-party apps, and let the other browsers fuck off.

Something could pop up saying "Fill password for HSBC Bank?" or similar and you click one button.

Yeah, I a think other browsers want to be able to test whether there is a saved password or not, and get the corresponding username, which is quite a big permission to give away. For actually filling in the password they could maybe offer a pop up where the user must authorise the app using biometrics or some other OS-level action. That’s already the experience with safari.

> allow this application to access all saved passwords

I'd like to see finer granularity, perhaps multiple web password vaults and a mechanism to allow certain browsers to use certain vaults.

It might also be nice to specify which passwords could be accessed with which kind of authentication. Unfortunately the current system password dialog is easily spoofable - it really looks like a questionable javascript popup.

What would that look like? Do you expect a prompt for every website you visit (Would you like to allow permission for Firefox/Chrome/whatever to view/store your password for "abcd.example.com"?) Would the permission be tied to the name of the app or the hash of the app? How do you securely identify the browser? Signed apps? Signed via a developer key -- trust the developer so that you can use Chrome as well as Chrome Beta?

The above is not a critique but certainly a list of things that lead to the possibility of a repeat of the infamous Windows popup for every single action you want to do out of the box. This leads to either decision fatigue or a pre-programmed "yes, just do it" response from the vast majority of users.

I personally think it should be an all-or-nothing type of allowance for this reason. Maybe the better way would be tracking access to passwords in Keychain. ie: Chrome+Safari+Firefox have all accessed your credentials for google.com but only Safari has seen your iCloud credentials and only Chrome has seen your HN credentials.

It's not unheard of - iOS already provides granular permission capabilities for photos. You don't have to give all-or-nothing permission to apps to access photos anymore; you can now choose precisely which photos the app has access to.

I'm looking forward to iOS doing the same for contacts; there's no reason why WhatsApp/Telegram/etc need access to my entire address book if I just want to call Steve.

>What would that look like? Do you expect a prompt for every website you visit

Why not? It works fine for Little Snitch.

And here it would be even less prompts, as it would just be every website I visit && have an login account at.

> Do you expect a prompt for every website you visit (Would you like to allow permission for Firefox/Chrome/whatever to view/store your password for "abcd.example.com"?)

This is pretty much exactly how macOS Safari prompts, and has for several years, at least in Touch ID scenarios. It shows a suggested username/identity with a Touch ID icon next to it, presented just like a normal autofill suggestion otherwise.

The per-site prompt and the inclusion of username/identity are really good signals, and feel like they reinforce the opposite of Windows UAC. They definitely gate access in a similarly repetitive way which encourages repetitive acceptance. But they demonstrate prior authorization that would have to be manual at least once at some point before the prompt, and you won’t be promoted the same way for sites you didn’t manually authorize first.

It’s a good enough signal that I generally use it as my first line of defense against phishing/domain spoofing. If I don’t get promoted for credentials for a service I expect to have an account with, I’m immediately suspicious. That doesn’t mean I automatically trust or distrust on that alone, but it’s a pretty decent sniff test.

>allow this application to kidnap you and have your mouth sewn to an asians mans ass

Obviously the browser doesn't need to have unfettered access.

It just needs to tell the password "hey there's a password on wellsfargo.com" and then the password manager asks the user if they want to use the password. And maybe give access to all passwords.

IDK, what does safari do?

Safari pops up a little box attached to the login text field asking you if you want to use the password for wellsfargo, so it seems like it’s asking keychain “do you have a password associated with this url?”. At least on modern MacBooks they also figured out a good UX flow, when that box is on screen you put your finger on the Touch ID button and it authenticates you, puts in the password, and goes to the next field or hits submit.

3rd party apps can and do use the Apple Keychain on macOS to store sensitive data. Though they can't integrate with Safari's password manager.

If you use Chrome Sync with passwords on macOS, Chrome actually stores the decryption key in the macOS keychain. Just open Keychain.app (/System/Applications/Utilities/Keychain Access.app) and search for "Chrome Safe Storage" to find it. That's the decryption key though with the actual encrypted password/sync data stored elsewhere. (So not possible to access Chrome passwords from the Keychain directly)

Safari Passwords (Apple's password manager) also stores passwords in the Keychain as individual entries and you can access them via Keychain.app

Isn't this the exact thing that got MS in trouble with anti-trust for Explorer? How is apple getting away with it?

No. Microsoft got in trouble because they were coercing OEMs to not include competing browsers.

Apple has no such problem since they don’t have other OEMs.

Same deal with why Google got in trouble with the play store.

> The fucking name of the screen is "passwords"! I shouldn't have to get farther than "pas" for it to be the first entry on the list, "pass" in the worst-case!

Weird. "pas" and it was top of the list for me.

In Spotlight, I need “passw” to see it. In the actual Settings search, I also need “passw”, and that only gets it to #5 in the list.

Also, Spotlight is bizarrely slow finding even local apps and things like Passwords. WTF

Did you tell it to ignore most local files?

Wow! Just discovered the Spotlight customization and it is so much faster and more useful when you remove certain locations and turn off definitions and Siri suggestions.

That sounds delightful. Sadly, while Apple documents “Suggestions in Search”, and I can even see that option when I search Settings for Siri, the option itself is missing from the Siri & Search page.

I get the same result as the parent. Search in Settings has gotten a lot worse with time.

When I type just "p" it's the second top most result. When I type "pa" it's already the first result.

Bizarre. That's on iOS for me, searching in the settings app itself. I have to type most of "passwords" just to get it to show up at all, and some of the ones that are showing up instead have only the most tenuous connection to the search term "password".

It used to show up for me after a couple letters, in the settings app, until a few iOS versions ago, IIRC.

It "learns" from previous searches.

Which is unfortunate, because it's not very good at it.

Anecdata: `pas` worked for me in Spotlight, Settings (both 13.3 Beta (22E5246b)) and Alfred (4.8 [1312]).

I use windows almost only for gaming (and CAD) too, and I've found that recently that the webapps, especially music and notes are good enough, and icloud drive and photos integration to windows actually work well.

But yes, passwords is annoying. You can use them on chrome on windows but not on MacOS, and on Windows it doesn't work on anything but chrome. Speaking of gaming, game launchers on windows can't get passwords from Apple and also seem to log me out all the time, so I have to revert to using my phone to see my password and manually type it in.

>> 2. On Mac it's tied specifically to Safari. I use Safari a lot but if I'm in a different browser then my passwords are unavailable.

> Yeah, this is super fucking weird. You'd think this would be connected in some fashion to "keychain", but nope

No it's not. I don't want some exotic product connect to a domain I have passwords in and prompting me for access. The password should be tied to the product you used to login with.

This is a misunderstanding of keychain vs. lastpass. One is designed to remember "safari passwords" or any swift/cocoa application implementing keychain. One key feature is: once stored in Keychain this information is only available to your app, other apps can't see it.

Lastpass and other similar products are designed as a data warehouse / vault for you security items. From there, plugins in browsers etc. can take over.

I will totally agree with the fact that the GUI is frustrating at best.

But on iOS I can use keychain from apps to find login information that is stored from Safari?

Yeah, I'm also a heavy user Spotlight Search and it's still impossible to get to Keychain settings. I suppose my higher level point was that it's damn near impossible to efficiently get to the keychain settings.

Alfred?

Not impossible at all. For me, ⌘-space, then typing pass is enough for Spotlight Search to suggest the Passwords section in System Settings.

>Yeah, this is super fucking weird. You'd think this would be connected in some fashion to "keychain", but nope.

It probably very much is. But Google would never add Keychain integration when they want to push you to their own password manager within Chrome

I can never tell if Apple is trying to kill macOS, but it’s things like this that make me wonder.

Step 63 of Mac setup is optimizing Spotlight by excluding a bunch of stuff from being indexed - kind of annoying but that's the solution