Apple Passwords Can Now Automatically Fix Weak and Compromised Passwords With Agentic AI

[Henrikr]

How about making safari work properly so we dont have to constantly using Chrome as a fallback? The only reason I use Safari is integration with Apple Pay and Passwords-app.

 

[TheDailyApple]

Just ran this, works really well for a beta - 10 out of 15 passwords with issues were updated. The ones that failed for me were:
- Delta
- Ticketmaster
- Xfinity
- Zillow

So you still the weak/repeated passwords on these sites. Noted. 👀

 

[fbadini]

Where is the Opt out please

 

[Sir_Macs_A_Lot]

If I can't select specifically which ones I want...I'm not using it. I don't want Apple to have that kind of access to certain accounts.

 

[Powerbooky]

This is a terrible feature. If you read through this you're giving Apple full access to your Password library with the ability to grant access to 1Password, mSecure and others. This means Apple will see, know and can use your account information to log into other sites to validate access upon changing passwords to ensure their changes worked. What is stopping them from doing something beyond a password change? That part isn't documented.

"Apple" doesn't have full access, but the iPhone (or Mac) does as it already has in a way.
I find it more dangerous that a part of the OS has the ability to change several passwords in one go. This will make it very easy for criminals that just had stolen someone's phone to change a whole bunch of logins very quickly. I mean even the current iCloud password security method of one hour delay isn't flawless.

This is something I really want disabled permanently, especially for online financial services.

 

[AriaAmaris]

I'm assuming if you do this it means your password data is being funneled through Google servers.

 

[Unity451]

This is a terrible feature. If you read through this you're giving Apple full access to your Password library with the ability to grant access to 1Password, mSecure and others. This means Apple will see, know and can use your account information to log into other sites to validate access upon changing passwords to ensure their changes worked. What is stopping them from doing something beyond a password change? That part isn't documented.

Apple (and all tech companies) already know everything about you... they're just now giving you the privilege of benefitting from it.

 

[Cmd031304]

If people are actually using a unique password for each service, then they should not have to change many passwords at the same time, which would make this feature largely useless.

Apart from that, I personally would not want to hand over something as critical as this to AI.

 

[Robert.Walter]

What could possibly go wrong?

Well. Like not much bc you have to initiate it. If it doesn’t store new p/w properly you can fish it out and put it in manually.

I kinda hope it does a log out and then log in with new password to show it works.

 

[Biro]

If this can’t be turned off then - and I’m not just being hyperbolic here - I may be done with Apple. This has disaster written all over it. After falling far behind on AI, Apple is trying to show us how cool and innovative it can be. Don’t do me any favors.

 

[Makosuke]

I could picture this being a genuinely useful and valuable feature for both technically inclined and novice types.

I auto-generate a strong password for every site and store it all in Passwords, but there are many old things that still have leftover, insecure passwords in them. They're not a bank or anything major--more like older forum logins--and I fix a few now and then manually, but having something to automate that process would be really great.

Likewise, for people who don't get the risks of insecure passwords, having something go and do that for them would hopefully make it frictionless enough to get at least some bad passwords out of circulation.

But... I can also picture this going horribly, disastrously wrong even if designed with the best intentions. Getting locked out is mostly a non-issue--the worst that should happen is you need to go through a password reset if something got screwed up and the AI ended up getting confused and telling the site your email address is the password or changing the password at the wrong site or something.

But unfortunately I can't go past should, into definitely won't--given how badly AI agents sometimes screw up, it's not particularly hard to imagine a badly-coded site and a slightly confused AI managing to tell the site that your new email address is your old password and your new password is your email address, effectively rendering you unable to get in at all. Probably rare, but with a company the size of Apple and the multitude of ways sites manage and mis-manage password change forms and methods, far from impossible.

More likely, though, is some catastrophic security issue or intentional breach where an attacker with sufficient access abuses the system to automatically reset every password you have and collect all the new ones, or a domain squatter or server-side attacker sets up the reset page to induce something malicious, or some other creative abuse I'm not even thinking of.

I believe Apple is serious about privacy and security, and I believe they have smart people who're working hard to make features like this actually good and safe, but I've seen enough go horribly wrong that it's going to take a lot to earn my trust.

 

[Robert.Walter]

Doesn’t work for me. 3 accounts found, couldn’t log in by itself

Beta’s gonna beta you know.

 

[Veoronox]

What could possibly go wrong?

Yeah it reminds me of recent Meta/Instagram vulnrebility where people were able to take over accounts using the Ai agent.

 

[Robert.Walter]

Where is the Opt out please

The opt out is not pushing the button to initiate the change(s).

 

[mulatosnarf]

Cool feature but nah I got it from here

 

[xj9000]

There is an open standard for .well-known URLs, if the site supports the 'change-password' url it probably makes doing this trivial. Note the Authors.

A Well-Known URL for Changing Passwords

 

[contacos]

I don't trust this. Apple cannot even get the password generating feature working correctly a lot of times to begin with. The amount of times I asked it for a secure password, proceeded in a registration process and the password was nowhere to be found and I needed to reset the password to login after completing a registration 😅 so annoying

 

[Ja50n]

No, absolutely not, never.

 

[ececlv]

It would be cool if there was an agent for deleting accounts and not just changing passwords Most of my accounts with "weak or compromised passwords" are on websites I don't use anymore.

 

[glitch44]

Is there a way to attach files to accounts in the password app yet? Occasionally I'd like to keep an important PDF (like a scan of an ID) encrypted with its accompanying account.

 

[nickbatz]

Great feature. I certainly haven't kept up with the dozens of compromised or reused passwords.

My question is how it's able to tell the server it's doing that.

 

[usmaak]

Well that's something that I'll be shutting off on day one.

Because I still use Windows for work, I keep my passwords in both Roboform and Apple Passwords. I don't need Apple Passwords updating my passwords because that will throw me out of sync with Roboform.

It's a cumbersome workflow but it's what I need for both operating systems.

Oh yeah, and I don't need Agent Apple messing with my passwords.

 

[Plutonius]

and if you have a subscription, Apple will even tell you what your new passwords are 🙂.

 

[ifxf]

This is super cool - I have some sixty passwords that need updating!

I don’t have sixty sites that need secure passwords. Even MacRumors falls into my don’t care category.

 

[BigBlur]

For a start, if Safari could correctly use the right password for each website without filling the wrong one, that would be good. It happens with maybe "only" 5% of my accounts but that is already quite frustrating.

Check to make sure you don’t have a password associated to the wrong site or vice versa, or have multiple entries. My mom had this problem until I went through and cleaned everything up.

Also, it also complains for reused passwords, but fails to understand that the reason why some passwords need to get shared across several websites is that there is just one account behind them. I see no way to silence such spurious warnings.

You can have a single password entry associated to multiple sites. For example, my Disney account is only in there once, but is associated to multiple sites where it’s used. I did not add it in or save it for each site individually.



Safari should do this for you automatically if you were to click on the key to show all your passwords when logging into a new site that doesn’t have a password saved yet. Pick the password you already have, and you’ll get asked if you want to add the site to the existing password.