News for hackers. Stuff that matters.

A comment on Apple silently uploads your passwords and keeps them. Parent comment

Re:Apple silently uploads your passwords and keeps them by ethangk on Friday November 01, 2024 @08:32AM (#42016309)
That’s relevant when storing a users password to verify that they’ve entered the correct data, but password managers (which Keychain effectively is, I believe) need to be able to retrieve the original password
[ Parent | on HN ]
Re:Apple silently uploads your passwords and keeps them by hello0904 on Friday November 01, 2024 @08:38AM (#42016362)
Frankly, you're confusing hashing algorithms, encryption and "IDs".

Authentication: "Prove you are you" (hash functions)

Secure Storage: "Keep this secret but let me get it back later" (encryption)

Identification: "Track who/what this is" (UUIDs/tokens)

[ Parent | on HN ]
Re:Apple silently uploads your passwords and keeps them by stouset on Friday November 01, 2024 @08:47AM (#42016426)
You are deeply confused as to how password managers work.

Password managers—all password managers—require stored passwords to be encrypted such that they can be decrypted. Otherwise they would have no possibly way to retrieve the stored secret for the sake of submitting it to the verifying party.

Best practice for verifiers is to use a one-way memory-hard password hash.

Keychain is a password manager.

[ Parent | on HN ]
Re:Apple silently uploads your passwords and keeps them by ziddoap on Friday November 01, 2024 @08:57AM (#42016503)
>Secure Storage: "Keep this secret but let me get it back later" (encryption)

This is what keychain does. You retrieve the passwords later.

So, no. It is not a one-way hash function as you stated.

[ Parent | on HN ]