Apples Password App ....... Not Safe!!!

[Pinkpoison]

So I was thinking of installing the Apple password app on my MacBook but I'm always cautious and dug around first ...
I found out that you don't have a master password, instead you use your Mac user account password, so if for example your Mac had to go in repair the technician would need your Mac user password to login and do the work, they then have access to your password app, and that's just one example of how flawed this is .....
Here is a rundown on why this app is unsafe ....

Any computer technician, IT dept personnel, any other admin account on your Mac (any admin can reset any user's password), scammer with remote access (common), thief who guesses or cracks your weak password (rare), familiy member or friend with your Mac's user password (common) can open the Passwords app and see and use all the passwords and open and use but not see the passkeys in the Passwords app. When biometric fails, the Passwords app asks for your Mac's password.

 

[Bkdodger]

I'm pretty sure that no passcode or password is passed on to a technician. I believe you back up your device which is then encrypted and data is scrambled.

Edit thinking phone didn't read MacBook in this case a temporary admin password can be used that you set up in advance.

 

[Pinkpoison]

I'm pretty sure that no passcode or password is passed on to a technician. I believe you back up your device which is then encrypted and data is scrambled.

Edit thinking phone didn't read MacBook in this case a temporary admin password can be used that you set up in advance.

Yes but you still have to give the password to the tech person so he can get into the device, then he has access to your password app, whatever password you set up is the one that gains access to the app, and how do you know the tech is trustworthy? you don't!
It isn't just technicians either ....
Remember you don't have a master passcode to the app, it's the Mac user account password.

 

[Bkdodger]

Yes but you still have to give the password to the tech person so he can get into the device, then he has access to your password app, whatever password you set up is the one that gains access to the app, and how do you know the tech is trustworthy? you don't!
It isn't just technicians either ....
Remember you don't have a master passcode to the app, it's the Mac user account password.

I haven't had a chance to review the process but I think a temporary admin will not be able to see the passwords in that app. I will have to do a little research on it. And if they reset your password all the passwords in that app are lost.

 

[carolineM]

Yes but you still have to give the password to the tech person so he can get into the device, then he has access to your password app, whatever password you set up is the one that gains access to the app, and how do you know the tech is trustworthy? you don't!
It isn't just technicians either ....
Remember you don't have a master passcode to the app, it's the Mac user account password.

You could always back up your Apple device and wipe it before submitting it for repair. You would then redownload the backup afterwards.

 

[Pinkpoison]

You could always back up your Apple device and wipe it before submitting it for repair. You would then redownload the backup afterwards.

That's a bit of faff though, there are safer password managers out there too .....
For myself I'll just stick to my tried and tested method.

 

[Pinkpoison]

I haven't had a chance to review the process but I think a temporary admin will not be able to see the passwords in that app. I will have to do a little research on it. And if they reset your password all the passwords in that app are lost.

Ok ....
Yes perhaps so but .... by then they will have seen all your passwords, maybe copied them, and yes, you can change them all but I had to do that recently, you don't realise how many you've got until you have to change them ....

 

[Pinkpoison]

Why Apple's Passwords app is huge security risk

IT consultant here. Apple's Passwords app is a huge security risk, pontentially a disaster. Here's why: Unlike a 3rd-party password manager, Apple's Passwords app doesn't use a unique master password and instead uses your Mac user account password. Any computer technician, IT dept...

forums.macrumors.com

 

[Bkdodger]

Ok ....
Yes perhaps so but .... by then they will have seen all your passwords, maybe copied them, and yes, you can change them all but I had to do that recently, you don't realise how many you've got until you have to change them ....

I think they won't be able to see your passwords with different sign in admin account only can reset your admin password

 

[Pinkpoison]

I think they won't be able to see your passwords with different sign in admin account only can reset your admin password

Maybe so but there are other security flaws with that app not just that,, I won't be risking it because there are much safer password managers out there ....
The ideal password manager should have a master password that has nothing to do with your device. ...

 

[Bkdodger]

Maybe so but there are other security flaws with that app not just that,, I won't be risking it because there are much safer password managers out there ....
The ideal password manager should have a master password that has nothing to do with your device. ...

I use Bitwarden across my devices now which was recommended to me on Android site and cross platforms

 

[Pinkpoison]

I use Bitwarden across my devices now which was recommended to me on Android site and cross platforms

Yes I think that was in a best of search I did ...

 

[carolineM]

Yes I think that was in a best of search I did ...

I have been doing some digging and it seems Apple have introduced a Maintenance Mode with iOS 17.