Re:Official Chrome extension to use iCloud Keychain Passwords
by pseudosavant on Monday July 17, 2023 @07:40PM
(#36765683)
"Download iCloud for Windows to use iCloud Passwords"... On Windows this requires 'iCloud for Windows'. A definite non-starter for me. There is no reason to have an extension like this call out to locally installed software for a cloud service like password management. I'm sure it can be done in JS/TS/Wasm within the context of an extension (doesn't have same-origin issue).
[ Parent
| on HN ]
Re:Official Chrome extension to use iCloud Keychain Passwords
by rzimmerman on Monday July 17, 2023 @07:54PM
(#36765835)
I don't know the internals, so I'm guessing, but for password sync between iCloud devices Apple might require a hardware protected key (like in a TPM). In which case it does make sense that this requires a native process running on the host. At least until that can be exposed in a meaningful way through a Web API. I doubt it's as simple as querying the iCloud servers for the plaintext password.
Re:Official Chrome extension to use iCloud Keychain Passwords
by cavisne on Monday July 17, 2023 @08:14PM
(#36766010)
Pretty sure 1Password has the same constraint. Lastpass did not but well... they dont have the best reputation anymore.
Re:Official Chrome extension to use iCloud Keychain Passwords
by tylerhou on Monday July 17, 2023 @10:54PM
(#36767255)
AFAIK in web TS/JS/Wasm you cannot mark memory regions as in-memory only (mlock on Linux). This means that the secrets in JavaScript can easily be leaked if the kernel decides to page V8 process memory (unencrypted) to disk.
This risk is unsuitable for an application that needs to handle sensitive credentials like an encryption key for all of a person’s passwords — or the vault itself.
Also, this is why I do not trust LastPass — they don’t run a native module, so how do I know that my vault isn’t just being stored on disk?