iCloud Keychain Gaining Password Warnings, Support for Generating Two-Factor Authentication Codes in iOS 14

[MacRumors]

Apple is working on some useful changes for iCloud Keychain, according to details found by 9to5Mac in a leaked version of iOS 14 that has been circulating for the last few weeks.

iCloud Keychain, for those unfamiliar with the feature, stores login names and passwords for websites and apps, with the information synced across a person's iOS and Mac devices through iCloud. It is a free and useful way to manage unique passwords for each different service used.

In iOS 14, iCloud Keychain will include warnings whenever a password is reused, which should help encourage users to select different passwords for each login. With all the password leaks these days, choosing a different password for each site prevents malicious entities from being able to access multiple sites that use the same password when leaked info is obtained.

Apple also appears to be adding a way to save two-factor authentication passwords, which would presumably allow iCloud Keychain to generate two-factor authentication codes to prevent the need for a two-factor authentication app. 1Password and other password management apps already have these features, and if Apple added them, it would make iCloud Keychain an appealing alternative to paid solutions.

Apple is working on quite a few other features for iOS 14, and details on what's in the works can be found in our iOS 14 roundup.

Article Link: iCloud Keychain Gaining Password Warnings, Support for Generating Two-Factor Authentication Codes in iOS 14

 

[QCassidy352]

IMO what iCloud Keychain really needs to truly compete with 1Password and other paid solutions is a radically overhauled/new version of Keychain Access (on the Mac) and some equivalent on iOS. A user interface that allows the user to interact directly with the stored information rather than everything happening invisibly.

 

[caliguy]

I'd love to see iCloud Keychain automatically adapt their 'Suggest' feature to specific password requirements. Some sites do not allow dashes, while others require a special character.

 

[stukdog]

New dedicated app. Please.

 

[FightTheFuture]

Apple also appears to be adding a way to save two-factor authentication passwords, which would presumably allow iCloud Keychain to generate two-factor authentication codes to prevent the need for a two-factor authentication app.

If this works as well as 1Password, I’ll be looking forward to dropping it.

 

[bsolar]

1Password and other password management apps already have these features, and if Apple added them, it would make iCloud Keychain an appealing alternative to paid solutions.

Not sure of all password management options out there, but at least Bitwarden offers these features even in the free tier.

Still, in general, I'm not sure it's a good idea to keep both passwords and 2FA secrets in the same "basket".

 

[ignatius345]

IMO what iCloud Keychain really needs to truly compete with 1Password and other paid solutions is a radically overhauled/new version of Keychain Access (on the Mac) and some equivalent on iOS. A user interface that allows the user to interact directly with the stored information rather than everything happening invisibly.

Would also need shared vaults to really compete.

 

[nattK]

New dedicated app. Please.

A cross-platform dedicated app. And a separate login. My work PC is not signed into iCloud.
[automerge]1585759045[/automerge]

Would also need shared vaults to really compete.

I can see them adding a Family Sharing feature.

 

[nutmac]

Much overdue. macOS's Keychain Access app is too complex and iOS (iPadOS)'s Passwords & Accounts too simplistic. Along with aforementioned two factor authentication and password audit, I would love to see:

• Family Sharing
• Group multiple logins for same website
• Manage credit cards, with support for verification number
• Other secure data like bank account, passport, wireless router

 

[calstanford]

2FA support is exciting

 

[danmart]

In iOS 14, iCloud Keychain will include warnings whenever a password is reused,

This feature is kind of there already. If you look at your list of passwords & accounts in Settings on an iOS device, then any site where the password is not uniques will have a warning triangle next to it.

 

[vicviper789]

Oh no not more warnings and pop ups...

 

[Appleman3546]

I love all of the non-optional popup warnings that Apple gives me. Please, more!

 

[JedWare]

Great for people that only live in Mac world but most people live in both windows and Mac and need solution that works across both. This is why it was very much appreciated that they supported third party password managers. If you need 2FA support I would recommend Authy. Literally nothing has worked better and syncs across your devices.

 

[Allards]

The Gui of Keychain is horrendous, it feels like a black box to me. That’s why I don’t store anything in the Keychain but using the free Open Source Bitwarden password manager. All the features I need are there with a good apps and cross platform support. I don’t see Apple offering a compelling alternative....

 

[konqerror]

I'd love to see iCloud Keychain automatically adapt their 'Suggest' feature to specific password requirements. Some sites do not allow dashes, while others require a special character.

They already do. First, there appears to be a preloaded list of patterns for popular sites, I've noticed different formats being suggested. Second, HTML5 already defines a way to tell the browser what makes up a valid password. My understanding is that, where the site has provided, password managers are smart enough to use that information to generate a valid password.

 

[mannyvel]

Apple hired the guy who wrote my 2fa solution (2stp), so hopefully he'll have the chance to bake some of that into iOS someday.

 

[Westside guy]

IMO what iCloud Keychain really needs to truly compete with 1Password and other paid solutions is a radically overhauled/new version of Keychain Access (on the Mac) and some equivalent on iOS. A user interface that allows the user to interact directly with the stored information rather than everything happening invisibly.

I use Keychain for home and LastPass for work. On the Mac, I think Keychain Access is fine. But not being able to access the secure notes on iOS/iPadOS is really limiting and annoying.

 

[adammusic]

Any word on autodeleting 2FA text messages?
Those things pile up

 

[calzon65]

Guess I better stop using Password as my password

 

[mazz0]

Ooh, I’d love an Apple alternative to Google Authenticator.

I’m not quite sure how that works actually. Is it a proprietary Google thing, or just Google’s implementation of a standard? I’ve seen some comments above by people using different tools - do sites need to explicitly support those tools, or can you use them anywhere where Google Authenticator would work?

 

[adrianlondon]

Ooh, I’d love an Apple alternative to Google Authenticator.

I moved to Authy (free) around a year ago. Much better. Plus it will sync across devices and has a backup/restore option.

While moving from Authy and Bitwarden to a new and improved keychain would be nice, it needs (a) a total re-write of the MacOS app (b) an iOS app and (c) access from non-Apple apps such as Firefox. Until all three exist I'll stick with my current options.

 

[ScooterComputer]

Just buy AgileBits, Apple… FFS. And if they won't sell, then buy BitWarden and end this mess. We need a better UX app to front end iCloud Keychain, and it needs to be cross-platform, including Windows and Android.

FWIW, Microsoft is already coming up behind you, if you're wondering to whom those footsteps you're hearing belong.

 

[JamieLannister]

J.

FWIW, Microsoft is already coming up behind you, if you're wondering to whom those footsteps you're hearing belong.

I wouldn’t trust Microsoft with my peanut butter jelly sandwich recipe let alone any security features

 

[posguy99]

Would also need shared vaults to really compete.

And be cross-platform. Even if you were willing to trust such information to a service provided by Apple.