Further, you can’t invoke Keychain in Apple’s non-Web login dialogs, making it useless for common purposes.

Tested this unintentionally after a hack: no reports emerged of any password vaults being unlocked.īut while it’s broadly useful in OS X, as more developers have adopted it and there’s Keychain Access for direct lookups and retrieval, in iOS you have to drill down to Settings > Safari > Passwords to view, edit, or (swipe all the way to the bottom) add passwords. ICloud Keychain uses device-based encryption which prevents Apple from being able to (or being compelled to) decrypt your passwords.ġPassword and LastPass use an “expensive” passphrase encryption method for your locally stored databases, so that even if someone gets ahold of them, a cracker can only brute-force password attempts at a very, very slow rate.

With Touch ID or a passcode in iOS and FileVault 2 in OS X, passwords are highly secure as well when you’re shut down (OS X) or locked (iOS).

OS X and iOS have to be unlocked to fill Keychain entries, and OS X’s Keychain Access app requires an administrative or user password to unlock and view passwords. Keychain and iCloud Keychain are pretty dang robust in these regards. Strong encryption should prevent a snooper from unscrambling new entries, retrievals, and updates, as well as interactive sessions. It should be difficult or impossible for an attacker to access and decrypt cloud-stored passwords.ĭata in transit while being synchronized or to and from Web-based access. Passwords should be secure on a device against anyone but the owner gaining access.ĭata stored on servers. How secure is your data?Ī password “safe” needs to keep the passwords, well, safe, in three major areas:ĭata at rest on a device. While Apple’s Keychain, 1Password, and LastPass can all store other sorts of data securely, passwords are the most reliable element that can used across a whole ecosystem and across platforms.

Lastpass v 1password