If you use Apple hardware, the new Apple Passwords app in iOS 18 makes your life easier by suggesting strong passwords and helping you manage them, all from one place.
But is the Apple Passwords app the safest option for you?
In this article we examine: 1) the benefits of relying on Apple for password management 2) the downsides of using Apple Password Manager, 3) the benefits of third party password managers and 4) which password managers have been hacked.1
What Is The Apple Passwords App?
The Apple Passwords app addresses the challenges the average, non-techie Internet user faces in following password best practices…
Specifically, when choosing passwords, your password entropy should be very high:
- Long (at least 12 characters)
- Complex (using upper and lowercase letters, numbers and special characters) and
- Unique for every website. Ideally, usernames should also be unique for every website…2
Man, that’s a lot to expect anyone to remember.
The Pros of Using Apple’s Passwords App
If you’re all in on Apple’s ecosystem, the Apple password manager has a lot going for it:
- Free for Apple users
- Manage website, app and WiFi passwords, verification codes and passkeys.
- Easily transfer passwords from a 3rd party password manager, such as 1Password, to Apple Passwords
- End to end encryption (i.e. Apple can’t see your iCloud Keychain data and nobody, not even Apple, has access to your passwords, passkeys or 2FA codes)
- Passwords are automatically backed up to your iCloud account
- Passwords are autofilled on websites when using Safari on trusted Apple devices, such as iPhone, Mac, etc. Works with Chrome and Edge via iCloud browser extension.3
- Option to download your passwords to a printed file as a backup
- Apple is probably not at risk of being acquired by another company, thereby putting your data in the hands of some 3rd party you neither know nor trust… And Apple probably isn’t shutting down anytime soon.
- Works with Chrome and Edge via iCloud browser extension. (Doesn’t require use of a browser extension for Safari users)
While a strong, unique password is not as secure as a physical security key, such as a Yubikey, at least with iOS 18, the new Apple Passwords app upgrades the user experience for passwords management.4
Are There Downsides To Using The Apple Passwords App?
There are also cons associated with the choice of using the Apple Passwords app, as opposed to a 3rd party password manager…
The downsides of relying on Apple for password management include:
- Trusting Apple with all of your data
- Less flexibility across different operating systems and browsers, such as if you rely heavily on a PC, Chromebook, Android mobile, Linux, etc. as opposed to being all in on Apple’s ecosystem.
- A single point of failure
- Apple is a very attractive target for hackers
- If someone gains access to your Mac computer password, they could gain access to all your passwords on your Mac
- Apple iCloud Keychain is closed source, meaning independent researchers can’t verify or check how it works or if there are bugs or security issues
Apple has a bug bounty program and is open about how it secures your data… However, iCloud Keychain is closed source, meaning independent researchers can’t verify or check how it works or if there are bugs or security issues.
Could Apple get hacked? Yes, there’s a non-zero chance that Apple could get hacked. No company is immune to being hacked.
However, I believe Apple (and the other tech giants for that matter5) has the most to lose if they get hacked. But, if they do get hacked, a company the size of Apple has all the resources in the world to throw at the problem.
You are more at risk of being the victim of a phishing attack or malware attack by falling prey to social engineering… As such, you should be aware of the risks of downloading unsigned Mac software and/or Mac malware, such as MacStealer, that could compromise the security of your iCloud Keychain.
Be sure to check the security settings of your Mac antivirus to enable your firewall and maximum protections because everyone is at risk.
Are Third Party Password Managers Better Than Apple Passwords App?
Third party password managers are available that do a great job of helping you manage your passwords, all from one place.
Companies like 1Password, Keeper, Proton, LastPass, Bitwarden, etc. offer similar functionality to Apple Passwords, and may also include other cybersecurity tools you may want, such as a VPN, encrypted email, malware scanning tools, etc.
However, the greater the number of services you rely on for managing your passwords and authentication, the greater your “attack surface” becomes.
Just like Apple is a target, 3rd party password managers are constantly under attack, fighting against hackers who stress test their systems.
Sometimes these password managers can get hacked or vulnerabilities can be found.
Which Password Managers Have Been Hacked?
- Apple Password Manager: As of the time of this post, Apple iCloud Keychain and Apple Password Manager have not been hacked…
- Keeper Security: According to their website, Keeper has not been hacked.
- 1Password: According to their website, 1Password has not been hacked.
- Bitwarden: According to their website, Bitwarden has not been hacked.6
- Proton Pass: As of the time of this post, Proton Pass has not been hacked.
- LastPass: According to their website, LastPass was hacked in August 2022. In a series of blog posts LastPass publicly acknowledged that an unauthorized party breached its systems… At first, the company revealed a breach of their systems, suggesting it wasn’t so bad. However, over the next few months it posted new blogs indicating it was actually quite bad… Hackers had accessed the vaults of some user passwords. As a result of the LastPass hack, and perhaps because it was acquired by a private equity company, some security researchers have suggested against using LastPass.
It’s important to emphasize that any company could suffer a breach that goes entirely undetected. Absence of evidence of hacking is not evidence of absence of hacking…
Some people really like third-party password managers, such as 1Password. For instance, Troy Hunt, a well-known Internet security expert who’s run the data breach website “haveIbeenpwned.com” for over 10 years, likes 1Password.
In other words, just because your favorite password manager hasn’t reported it or they are not aware of being hacked, or having your data compromised, doesn’t mean it hasn’t happened.7
Summary
A password manager is an excellent tool to have as an option in your security arsenal. Using one can offload a lot of the work you need to do to stay safe online. This includes:
- Generating strong passwords for you using randomness and high entropy.
- Automatically filling passwords in websites so you don’t have to type them, reducing the risk of a keylogger malware attack.
- Storing passwords in an encrypted format, in hash form, so that they’re useless to anyone who gains access to them without the company’s encryption key.
- Checking your passwords against known breaches of websites and helping you change the passwords.
- Making it easy to share your passwords with others if you want to.
Any password manager needs to strike a careful balance between security and customer experience, and in this regard Apple has the best chance of nailing this approach for its customers.
That said, every company – including Apple – is at risk of being hacked. This includes excellent, well-established password manager companies, like LastPass, 1Password, Keeper, Proton, Bitdefender, etc.
Apple has virtually unlimited resources to throw at user security, and has potentially the most to lose in the event of a breach… As such, it may be as safe a choice as any 3rd party password manager if you rely on Apple’s ecosystem.
Upgrade Your Password Management With Yubikey
Keep your online accounts safe from hackers. YubiKeys use secure public key cryptography and require the user to touch or tap the touch sensor to authenticate... This verifies you as "real" and helps prevent remote attacks that may bypass software-based MFA.
Footnotes
- Using a password manager is a personal choice, and it's not for everyone. Some cybersecurity experts disagree that password managers are the best option, preferring other approaches such as using a formula for generating and remembering passwords, or writing them down old school style with pen and paper in a book. The problem with the former (using a formula) to me is human memory... And inconsistency in sticking with a naming convention. I have so much crap going on and so many logins that relying on my memory to manage it all in a pinch, regardless of my distraction level that day, is just too much. The latter (paper) is great, for a backup... You should probably have a hard copy located somewhere your loved ones are aware of, in the event you get hit by the proverbial truck. But I'm never going to take a physical password diary with me everywhere, so for daily needs it's a non-starter. As such, I think a good password manager is probably the best option for most people.
- Strong two-factor authentication should be used by default on any website or app that offers it. Frankly, too few are offering this.
- In addition to convenience, autofill has the added benefit of helping you be less susceptible to keylogger malware.
- Previously, this function was solely accessible from within the "Settings" menu on your iPhone.
- Amazon, Microsoft, Google, and Facebook
- Bitwarden experienced some controversy recently regarding its use of an auto-fill password feature on websites using iframes. The auto-fill feature was a security choice that provided users with more convenience, but left users of Bitwarden potentially open to an incremental an additional vector of attack by spoofed iframes on websites. This feature is turned off by default.
- One of the largest supply chain attacks in history, the Solarwinds cyber attack, went undetected for over a year before it was discovered.
