How to Use Automatic Strong Passwords and Password Auditing in iOS 12

[nwcs]

Passwords are a mess. We keep upping complexity and now we’re at a point managers like these are nearly mandatory if you care at all about security.

Not sure what the long-term solution is but whatever it is will have to NOT be a PITA for widespread adoption (3FA etcetera are probably not the answer in that case).

The long term is likely to be some form of biometrics authentication. But it will be a long time to come unless support is baked into various frameworks and APIs.

 

[konqerror]

I would speculate it’s for readability. The fact there are hyphen in “known” positions is irrelevant.

The hypen is mainly to satisfy websites that require a special character, along with readability. With machine generated passwords, special characters aren't required, entropy is entropy.

The long term is likely to be some form of biometrics authentication. But it will be a long time to come unless support is baked into various frameworks and APIs.

Already done on Windows. You sign in with fingerprint/face/PIN, which is bound to your TPM (a.k.a secure enclave). Then the Edge browser automatically signs you in via FIDO to Microsoft, Office 365 and sites that talk with Azure Active Directory. Called Windows Hello for Business. Works amazingly well.

 

[GreyOS]

Can you edit that strong password? There are a lot of stupid websites that don’t take passwords longer than 10 characters or accept the dashes.

If the website is set up properly then iOS can read the requirements and generate the strongest password possible. It says this in the iOS 12 security paper.

 

[iapplelove]

So far no entires with warning symbols..and my passwords are not even stupid long either, like 12-16 characters.. maybe they are long enough.

 

[dmaxdmax]

What if I want to share PWs with my wife? Our current system is we have 8 characters that preceded every site. For example:
5west4thAmazon!
5west4thGoogle!

The 5west4th isn’t written down anywhere. It isn’t perfect but we aren’t protecting the launch codes and it’s better than QWERTY. We know what the other will have used when creating a new account, at least 90% of the time.

Do any of the managers allow two people to share passwords without jumping through hoops?

 

[mattyj2001]

Rant below: I don't trust iCloud with all my passwords. I use it for low-tech sites just cause I'm lazy and know I can reset it by email if needed. Besides those, I just have a few passwords I remember, with a quality level for each. Every account I don't care about has the same exact password. 2 more passwords are reserved for semi-important things that have 2FA anyway, maybe with the name of the site on the end. Only a few special things with no 2FA, like my PC, get a unique password.

I would rethink your password reuse policy. Even if an account is something you don't care about, all those accounts combined, and breached with the same password, might give someone more than enough info to masquerade as you online. Maybe the last four digits of your SSN comes from one site, your cat's name from another account, your gradeschool from another account... Not caring about the site/app is one thing, but each of us should really care about every piece of personal info that's out there, no matter how small. Don't give up multiple pieces of the puzzle so easily.
[doublepost=1537487663][/doublepost]

[doublepost=1532654726][/doublepost]A few comments:

1. This assumes that all sites, apps., etc. etc. need or deserve the same degree of security. For some, all this rigmarole is obviously necessary. But for others (such as websites I visit which store no personal information, allow access to my finances, etc. etc.) they fall more in the "unwelcome nuisance" category. So thanks any, but I'll stick to short, simple, easily remembered ones.

If a site thinks you need a password, then they are certainly collecting something about _you_ (browsing habits? which products you click on or purchased?) that a thief might want to know. Just having my email address saved with a useless account is enough for me to want to use unique passwords everywhere.

[doublepost=1532654726][/doublepost]
2. Different people have different security needs. For inst., I am old enough that sooner or later I am scheduled to wake up dead one morning, and the executors of my estate will require quick and easy access to all the information they will need to do their jobs. So I have made a deliberate decision to maintain a simple password for my desktop Mac. Call me smart, call me stupid, this is the personal choice I have made and I would resent it if Apple were to take this freedom of choice away from me. This is a situation in which Apple's tendency to impose "one size fits all" solutions on its user base would be a very bad idea indeed.

I'm in a similar boat, age-wise, but I couldn't care less about executors and whatnot after I'm dead. The important things are safely filed with the proper authorities, in a place and/or with a person my wife is aware of. Nobody is really going to need to know my BestBuy.com password after I'm dead. My $10 award isn't that much of a loss.
[doublepost=1537488082][/doublepost]

What if I want to share PWs with my wife? Our current system is we have 8 characters that preceded every site. For example:
5west4thAmazon!
5west4thGoogle!

The 5west4th isn’t written down anywhere. It isn’t perfect but we aren’t protecting the launch codes and it’s better than QWERTY. We know what the other will have used when creating a new account, at least 90% of the time.

Do any of the managers allow two people to share passwords without jumping through hoops?

1Password has the notion of shared vaults. My wife and I don't use it but I know it's there!

 

[Mr. Heckles]

I prefer not to use automatically generated passwords because they eventually are reversed engineered.

This has to be the dumbest excuse ever not using this. Really?

 

[Mr. Heckles]

What if I want to share PWs with my wife? Our current system is we have 8 characters that preceded every site. For example:
5west4thAmazon!
5west4thGoogle!

The 5west4th isn’t written down anywhere. It isn’t perfect but we aren’t protecting the launch codes and it’s better than QWERTY. We know what the other will have used when creating a new account, at least 90% of the time.

Do any of the managers allow two people to share passwords without jumping through hoops?

1Password can easily. My wife and I have a shared vault for called bills that we can not access easily. And if one of us changes the password, the other person will get the updated info automatically. Probably one of the best features.

 

[fairuz]

I would rethink your password reuse policy. Even if an account is something you don't care about, all those accounts combined, and breached with the same password, might give someone more than enough info to masquerade as you online. Maybe the last four digits of your SSN comes from one site, your cat's name from another account, your gradeschool from another account... Not caring about the site/app is one thing, but each of us should really care about every piece of personal info that's out there, no matter how small. Don't give up multiple pieces of the puzzle so easily.

Sites I don't care about have nothing on me but a username/email, often not the same one. They're usually ones where I'm forced to make an account for no good reason. It'd also take a very intense manual effort to even attempt that kind of attack on me.
[doublepost=1537502292][/doublepost]

If it’s stored in a password manager, I wouldn’t see the problem. The problem I see are the sites that have password length limitations like 8-10 chars and also don’t accept many non alphanumeric characters so the password is inherently weaker from the start.

I haven't encountered a site requiring ≤10 alphanum chars. If those exist, that's sad; they're probably not even hashing your password if they're that incompetent.
[doublepost=1537502342][/doublepost]

I prefer not to use automatically generated passwords because they eventually are reversed engineered.

This isn't a real concern. I thought you might want reasoning instead of just being insulted by the guy above... They use a secure source of randomness, which is meant to be impossible to reverse-engineer but could in theory be broken if someone makes a really bad mistake. As long as that's in place, it doesn't matter what else is known about the password generator.

Same goes with that trick of using 4-5 English words. Doesn't matter if attackers know you're doing that as long as you're truly randomly selecting the words. Sadly a so-called "security expert" wrote a really flawed blog post saying it's insecure because attackers know you'll use 4 words. You should really only trust authorities on security, which means don't take my word either.

 

[McG2k1]

I’ve been using LastPass for years and years. It’s a little awkward to get to on the phone, but it’s never been a problem and I highly recommend it. It unlocks with faceID or a master pass phrase and fills the stored password, or credit card info.

 

[TriBruin]

1Password can easily. My wife and I have a shared vault for called bills that we can not access easily. And if one of us changes the password, the other person will get the updated info automatically. Probably one of the best features.

This is one the main reasons I use 1Password and (gasp) pay their subscription fee. I use shared vaults for different types of password. Video sites (Netflix, etc.) that I want to share with my family are in one vault. Banking websites are only shared with my wife. Work passwords are in their own vault. And my personal password in another.

 

[ignatius345]

As long as it doesn't force me to use excessively long and confusing passwords, I'm ok with this. I know many sites, institute insanely long and complex passwords so this may be helpful

Passwords only feel "excessively long and confusing" if you're trying to remember them. If you're using a password manager you trust and have on you all the time, you can ditch memorability as a factor and make them as hack-resistant as possible.

 

[weckart]

The long term is likely to be some form of biometrics authentication. But it will be a long time to come unless support is baked into various frameworks and APIs.

I have a few apps I can sign into on my iPhone via Touch ID, including my bank accounts. A few on my spare Android phone also accept fingerprint authorisation. Depends whether developers or website managers think it is worth the effort incorporating this.

 

[TwoBytes]

Apple need a proper password manager of some kind then I can stop my expensive 1password subscription and get and get an even more expensive apple subscription.

 

[ignatius345]

2) There is no means to access the saved passwords outside of fully connecting to your iCloud account on an Apple device. So if you lose/damage your iPhone (or iPad or Mac) and don't have another Apple device available you that you are able to connect to iCloud as a primary account you are completely locked out of EVERYTHING until you replace that Apple device with another Apple device. Clever on Apple's part but infuriating the moment the customer realises it.

Yeah, I got locked out of my iCloud account briefly while travelling and it was a little scary, honestly. Using a trusted third-party password system like 1Password or LastPass might be the way to go, then. I believe 1Password also allows you to export your passwords to something universally readable like CSV.

3) Each time you want to access a password you need to use a credential that protects ALL of your other credentials. This means that primary credential is used more often making it more susceptible to "breach". Credentials are typical most at risk at the point/time of entry so the more you need to use it the more at risk it is.

It's a matter of weighing convenience and usability vs. the actual security threats you face. If you're a journalist or a political dissident or a celebrity, sure, you might want to have a few layers of security -- but I suspect that for the vast number of people having one very strong password (my 1Password master password is over 20 characters long but still memorable by me) is probably going to deter everyone you need to deter without making your life hell every time you want to log into something.

4) It is all highly presumptive that everything is working right.

I'm always skeptical of this too, but 1Password works online or off, and I'm several years into using it with not a single glitch. Again, having a CSV or text file backup of your passwords kept somewhere safe is probably not a terrible idea...
[doublepost=1537559704][/doublepost]

What if I want to share PWs with my wife? Our current system is we have 8 characters that preceded every site. For example:
5west4thAmazon!
5west4thGoogle!

The 5west4th isn’t written down anywhere. It isn’t perfect but we aren’t protecting the launch codes and it’s better than QWERTY. We know what the other will have used when creating a new account, at least 90% of the time.

Do any of the managers allow two people to share passwords without jumping through hoops?

1Password does. I have a vault that's strictly my own, and another I share with my wife for household/shared stuff like Hulu, utility company logins, etc. It works beautifully.

 

[burgman]

I have a few apps I can sign into on my iPhone via Touch ID, including my bank accounts. A few on my spare Android phone also accept fingerprint authorisation. Depends whether developers or website managers think it is worth the effort incorporating this.

But you still need a password to set it up or use the website.

 

[lederermc]

This new password function in Safari is crap. It's failing to remember the password in both the Safari prefs and in keychain. On one web site it alters the field that has an email to be the user-ID which makes the web site unable to execute a change of PW.

 

[manu chao]

I would speculate it’s for readability. The fact there are hyphen in “known” positions is irrelevant. Even if a cracker “knew” the password was generated by Apple’s latest gen pw engine (that’s a big ‘if’), and that there were a specific number of groups of characters of a specific length, there are still sufficient unknown characters to make the password “uncrackable” with today’s technology.

Exactly, one should think of the password as being everything without the hyphens, like with spaces in credit card numbers.
[doublepost=1537630776][/doublepost]

What if I want to share PWs with my wife? Our current system is we have 8 characters that preceded every site. For example:
5west4thAmazon!
5west4thGoogle!

The 5west4th isn’t written down anywhere. It isn’t perfect but we aren’t protecting the launch codes and it’s better than QWERTY. We know what the other will have used when creating a new account, at least 90% of the time.

If one of the sites that you use these passwords on gets hacked and your password gets out, it is hardly rocket science for the attacker to understand your password system and everything linked to the same email address could get compromised.

Do any of the managers allow two people to share passwords without jumping through hoops?

1Password does but only on a subscription plan.

 

[Mr. Heckles]

1Password does but only on a subscription plan.

I did this way before subscription. My wife and I shared a Dropbox account, and it had 3 vaults in it. One was mine, one was my wife’s, and the other was for bills. My 1Password would have mine and the one for bills, and her 1Password has hers and Bills. You can easily move stuff from one valut (my personal) to the shared vault (bills).

 

[Infinite Vortex]

It's a matter of weighing convenience and usability vs. the actual security threats you face. If you're a journalist or a political dissident or a celebrity, sure, you might want to have a few layers of security -- but I suspect that for the vast number of people having one very strong password (my 1Password master password is over 20 characters long but still memorable by me) is probably going to deter everyone you need to deter without making your life hell every time you want to log into something.

Exactly. Each "system" has its flaws and one needs to weigh those flaws against the benefits. The problem is that most people don't stop to think that their exposure isn't limited to the site/device that was broken. The second a credential pair is compromised *every* site/resource that uses that same pair is compromised. Not only that, you have no idea when the breach occurred so the moment you're made aware the clock isn't ticking from that time, rather, it started at the time of the breach which was who know when.

Because of this, rather than having unique passwords I obfuscate though unique email addresses/user IDs. So if a credential pair is compromised its stops there at the one site/location. Metaphorically, rather than having unique keys for each door that's the same, I'm hiding the doors. Which means irrespective of whether you have the right key you're going nowhere fast unless you're able to find the right door.

Of course this means needing to document email addresses but even then that's only half of the credential pair anyway. And in having documented all of the email addresses if the time comes when a pair is compromised I have a concise list of what I have to do and where I have to change things.

PS BTW, when I mean unique email addresses I don't mean silliness like apple@, google@, adobe@, netflix@ etc. I mean addresses like b8efcjh@, fkrm5yap@, j3msqtcr@, xh6gbdtz@.

 

[ignatius345]

Of course this means needing to document email addresses but even then that's only half of the credential pair anyway. And in having documented all of the email addresses if the time comes when a pair is compromised I have a concise list of what I have to do and where I have to change things.

PS BTW, when I mean unique email addresses I don't mean silliness like apple@, google@, adobe@, netflix@ etc. I mean addresses like b8efcjh@, fkrm5yap@, j3msqtcr@, xh6gbdtz@.

This seems like a lot of admin work to me, but if you need it, Gmail's "plus addressing" is useful for generating on-the-fly unique addresses -- though some website struggle with them.

 

[Infinite Vortex]

This seems like a lot of admin work to me, but if you need it, Gmail's "plus addressing" is useful for generating on-the-fly unique addresses -- though some website struggle with them.

Nah, I manage my own domains and I can bulk create them in hundreds at a time all forwarding to a single address. Once created I just grab the next free one in the list. The trick part is mostly the keep of a few free ones around on my phone & iPad for when I'm not in front of a computer. Just grab a few and stick them into Notes.

 

[fairuz]

Another problem are sites that automatically cut the length without telling you. You generate a password, everything seems fine, you can't login. After resetting multiple times you figure out it was only taking the first 16 or so characters from the auto-generated password and ignoring the rest.

idk about now, but Mac OS X Snow Leopard used to do that in extreme cases. I set an excessively long password (which I know is dumb) and got locked out.

Honestly I can't think of many sites with dumb password requirements. The one nasty one was for checking my Princeton decision, which was even dumber because they could've just emailed me it. Was something like 16 characters, mixed case, no consecutively same characters, no using the same character 3 times in total, and a special character that can't be at the beginning or end... I don't even know what other rules there were cause they only told me a rule if I broke it, so I ended up totally unable to find a suitable password and had to randomly generate one (took two tries). Wrote it down because it was impossible to remember.

 

[manu chao]

I did this way before subscription. My wife and I shared a Dropbox account, and it had 3 vaults in it. One was mine, one was my wife’s, and the other was for bills. My 1Password would have mine and the one for bills, and her 1Password has hers and Bills. You can easily move stuff from one valut (my personal) to the shared vault (bills).

Just a note of caution on this method: If two people access the same (shared) vault at the same time, in particular if two people edit the content of the same vault at the same time, Dropbox might not be able to reconcile things and some changes might be lost.
[doublepost=1537690377][/doublepost]

idThe one nasty one was for checking my Princeton decision, which was even dumber because they could've just emailed me it. Was something like 16 characters, mixed case, no consecutively same characters, no using the same character 3 times in total, and a special character that can't be at the beginning or end... I don't even know what other rules there were cause they only told me a rule if I broke it, so I ended up totally unable to find a suitable password and had to randomly generate one (took two tries).

Maybe they took the idea of randomness too serious and decided to let their password rules to be created randomly.
[doublepost=1537690964][/doublepost]

Because of this, rather than having unique passwords I obfuscate though unique email addresses/user IDs. So if a credential pair is compromised its stops there at the one site/location. Metaphorically, rather than having unique keys for each door that's the same, I'm hiding the doors. Which means irrespective of whether you have the right key you're going nowhere fast unless you're able to find the right door.

Of course this means needing to document email addresses but even then that's only half of the credential pair anyway. And in having documented all of the email addresses if the time comes when a pair is compromised I have a concise list of what I have to do and where I have to change things.

Does it really matter which part of the credentials pair is unique (and random)? Regardless of which part of the pair you randomise, you need a method to create a random string and a method to store it. Of course there are often other elements attached to a credentials pair that one would also ideally like to randomise: shipping address, payment method, birthday, security questions. The latter two can be randomised, the former two much less so. However payment methods that are attached to your email address (PayPal, Apple Pay) avoid giving out another unique identifier (credit card number).

 

[dmaxdmax]

Exactly, one should think of the password as being everything without the hyphens, like with spaces in credit card numbers.
[doublepost=1537630776][/doublepost]
If one of the sites that you use these passwords on gets hacked and your password gets out, it is hardly rocket science for the attacker to understand your password system and everything linked to the same email address could get compromised.

1Password does but only on a subscription plan.

A couple of critical sites have their own pw - bank, brokerage - but I’m willing to take the risk on Hulu, Hilton Honors, etc