Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Passwords App Bug Left Users Vulnerable to Phishing Attacks for Months Before Being Fixed
- Thread starter MacRumors
- Start date
- Sort by reaction score
Definitely good advice. I'd argue the password is a secondary security measure, and geared more towards older security practices. MFA of some kind seems to be (and should be) pushed more. Between two yubikeys, and a half dozen different authenticator apps on my phone, presume keeps most of my accounts a lot more secure than password alone.
People solving the nonproblems. Just don’t reset your password on a public network, ffs.
This is the issue with Apple apps. They are only updated with an entire iOS software update as opposed to 3rd party developers or even Google in the Play Store whose apps are updated through their stores with bug fixes and new features.
Amen. You're so right. Forums and social networks are plagued with this type of non-news and people overreacting to it. Most people don't think before posting their comments. Please put things in perspective before posting comments.
Apple has been releasing code with poor coding practice for the last 5+ years. This is no surprise. Cook does not understand software and therefore thinks software development can be sourced to the lowest cost country.
Oh wow good point. I didn’t know that they weren’t doing HSTS.
Ugh is it too much to ask for multi hundred billion dollar companies to follow best practices?
I feel that if there’s one thing worth giving a company money for, it’s to keep my most important info secure. It’s $3 / month. That’s cheap for what you’re getting! Defending against ongoing threats requires ongoing development.
Excessive software change a numbers game that leaves the consumer at risk. The old school slow down to speed up valid.
For far too long, Apple has been doing software development the Adobe way: add features with fanfare, fix bugs because of news broadcasts.
Apple privileges themselves and their apps in nearly every case. It's not new, and it leads to things like this bug and the long list of EU demands that they just received today.
It also makes me sad that Strongbox was just acquired for this reason. This is why I was encouraged by Passwords, I was hoping for a really good (interoperable!) example to set the standard for something that is no longer optional. But Apple doesn't seem to have much time to iterate their apps anymore. They have too many distractions.
Looks like the only option for a password manager is going to be a subscription to a service sooner rather than later.
KeePass is still too Windows only. Bitwarden seems to be the last holdout but I'm waiting for something to ruin that too.
KeePassium is pretty good as an Apple device-friendly KeePass client. It has a iOS/iPadOS and a MacOS Catalyst app. Not quite as polished as Strongbox, but fully open source. Free + subscription, and Pro version is a one-time purchase.
I couldn’t stand being so paranoid as to worry about people sitting at my front door, hacking my wifi just to get a password for my light switches.
Last edited:
I bought Strongbox “lifetime” a while ago but turns out lifetime ain’t what it used to be. Assuming the new owners still honor it I’m not sure I’ll still want it.
Not looking forward to having to buy another license just to eventually get screwed again. It may be open source but if someone is receiving money they can sell out and I’ll be in the same boat.
Seems we can either choose between truly free but no promises and paid but also no promises.
Technically--until the 18.2 security update was released--the vulnerability was Private
They actually want access to your EcoB w/Alexa so as to capture all one's post-shower pep-talk convo . . . and the really gritty-narsty stuff, like appointments made with Pest Control and Com-Post-Now techs
$5 a month if you have a partner, but on their website they do advertise as one of their most important features…
- Friendly email support
They also have there fair share of breaches and vulnerabilities
"When malware or a malicious user gains full control over a user’s device, there is little that can be done to guarantee its security. We have since addressed the vulnerabilities within our control"
I’m a fan of 1Password, but let’s not pretend they are actually better than Apple.