In the summer of 2020, I read about a Brazilian man whose iPhone was stolen right out of his
hand. Despite his best efforts to lock it up, he still lost over $30,000 because once the thieves
easily bypassed his six-digit passcode, they had automatic access to all of his banking,
user accounts, and iTunes purchasing. Because of the way iCloud Keychain, the default password manager used by every single iPhone
and Mac since 2013, is designed.
So let's explore how iCloud Keychain works and how you can keep your digital life safe.
According to a recent study by NordPass, the average internet user has over 100 user accounts
and passwords to manage. That's insane, so what most of us do is use the same or nearly the same password for everything.
This is not good because it leaves you vulnerable to getting stuffed.
Credential stuffing is when a hacker buys a database of logins from a compromised site,
like say when Yahoo got hacked in 2016 with a 3 billion user breach.
And then they try those logins on hundreds of other sites, like your bank or iTunes.
The best solution to avoid this is to have a different unique password for each one of
your accounts. But how on earth are we to remember over 100 strings of passwords?
Each with their own numbers and special characters.
Enter iCloud Keychain. It's Apple's solution to this very pernicious problem.
If you use any of the company's devices, you're probably already using it.
You've probably seen the pop-up on your phone or iPad or Safari browser, asking if you want
to save your password. If you tap yes, it's saved to your Keychain.
But still, if you're creating a new account, the feature can help you create really secure
passwords and you can save credit card and address info for online shopping.
And all of these credentials are synced between your devices through the cloud, which you
may have switched on during your iPhone setup. Simply put, iCloud Keychain is Apple's implementation of what's known more broadly as a password
manager. There are many options in the world of password managers.
The aforementioned NordPass is one, as are OnePassword, Dashlane, and LastPass.
The services are quite a bit more fully featured than iCloud Keychain, but they also cost money,
ranging between $1.50 to $4 a month for individual plans.
They work on all the platforms and with all the browsers.
And individual credentials can even be shared with others.
All that info is encrypted behind a MasterPass phrase, which is a password you make incredibly
long, strong, and ideally nonsensical, like Unicorn Milk Poison Control or Tusken Winter
Battle Skies exclamation mark.
What's convenient is that you can always have the right password when you need it, no
matter where you are, and it's all behind that MasterPassword.
But critically, that's not how iCloud Keychain works.
Your Keychain MasterPassword is the same as your device's password, so the weak password
you've been using for years on your MacBook or the convenient passcode you used to quickly
get onto your iPhone could be all that stands between would-be thieves and your treasure
trove of passwords. This is why the victim of our earlier story was so brutally compromised.
The thieves cracked his iPhone passcode and thus had access to his entire library of passwords,
including the one for his Apple ID. So if you're using your iPhone or iPad with a 6-digit numeric passcode, you should probably
consider an alphanumeric password like you use on your computer, which for face ID users
in the middle of a messed up COVID pandemic is a massive inconvenience.
iCloud Keychain is also not as flexible as the big password managers.
On your Mac, it only auto-completes on Safari, and though I'm pleased to report it's now
available on Windows PCs, like this laptop, it only works on Chrome and there are hoops.
First, you need to install Apple's iCloud software before you can even get the Chrome
extension, and then every time you freshly open Chrome, you have to input a two-factor
code that you get from the same device.
And before you get too excited, it doesn't work on Chrome for Mac.
So should you keep using iCloud Keychain? A lot of times I hear people say that having all your passwords stored in the cloud is
a big risk. And I understand, your passwords are somewhere you don't control, and you have to just trust
that they're not going to be compromised, like they have been everywhere else.
But that's the reason why you should get a password manager. You can have a hundred different passwords for all of your accounts, and password managers
like iCloud Keychain will store and transfer those passwords behind encryption, which is
only unlocked with your master password. I've personally struggled with whether or not to use iCloud Keychain since it came
out in 2013. But there are two factors that have me rethinking things.
First, Apple opening up to Windows users, like I mentioned earlier, does make it significantly
more viable should your digital life fit within those limitations.
Then, starting March 16th, the last pass free tier, which has been arguably the best option
for a while now, will be restricted to either all PC access, or all mobile access.
But not between the two. As a free option, iCloud Keychain is now the best of the bunch.
But if you care about maximum security, flexibility, and features, paying for a password manager
might be the better option. Whatever the case, I think it's important to practice good password hygiene by ensuring
you don't reuse passwords. And if you do choose to use a password manager, make sure that its passphrase is long, strong,
and memorable. Since I better practice what I preach, I should probably get on updating some of my older
passwords. Thank you for attending this Mac Address.
Passwords are certainly a big pain. Comment below with the worst password you use.
I just, please don't do that. You can comment about other things, however.
And if you learned something, go ahead and give me a like and subscribe. Oh, thank you.