Why you shouldn’t use iCloud Keychain for all your passwords
With the introduction of iOS 15 and the ability to store 2FA tokens in iCloud Keychain, some people have been considering relying on this tool to store all their passwords.
The recent LastPass hack is also making people reconsider their password manager, and I hear many are considering moving to iCloud Keychain.
I personally believe you should not use iCloud Keychain to store all your passwords, and a dedicated password manager is safer, let me explain why.
What is iCloud Keychain?
To put it simply, iCloud Keychain stores your passwords and autofills them when you need to login. It syncs through iCloud and it’s available on iOS, iPadOS, MacOS.
For more details you can check the following Apple support pages:
https://support.apple.com/en-us/HT204085
https://support.apple.com/en-gb/HT202303
Why shouldn’t I use it?
At first sight, iCloud Keychain looks very useful and convenient. It does everything a normal user needs:
- Suggest strong passwords when signing up
- Autofill passwords when logging in
- Can be used to store 2FA tokens
- Shared across devices
- It’s possible to access your passwords and login items by opening it
Sounds great, right?
It does and it’s definitely safer than re-using the same compromised password or writing password in the Notes app or unsecured locations.
But… Let’s look more carefully at the last feature:
It’s possible to access your passwords and login items by opening it
To access your passwords, on iOS you can simply go to Settings → Passwords and after authenticating with TouchID or FaceID or PIN, you can access all your passwords.
Let me highlight how to access it again
after authenticating with TouchID or FaceID or PIN
This means, your phone lock PIN (usually 6 digits) is all it takes to access all your passwords.
But nobody knows my PIN
Well… maybe, but here is a list of people who could have access to your PIN:
- Family and friends if you ever shared an iPad with them (because Apple doesn’t allow multiple accounts on iPads)
- People who see you unlocking the device sitting behind you on buses, trains or streets (because TouchID and FaceID work most of the time..)
- Airport security in some countries (like USA) where you are required to give them your PIN if you are selected for screening
- And last but not least:
Why a password manager is safer
You might be wondering why a password manager is safer, after all, all of the above could also happen with a password manager.
It could be the odds are quite low:
- Password manager access is usually safeguarded by a strong password, not a PIN
- Sharing an iOS device in a family is common, so they will know your pin, but nobody normally asks to share your password manager password, people usually ask for a specific password (like.. Netflix)
- Having access to your device PIN doesn’t guarantee access to the password manager app
- Password managers have functionalities that allow to remove and restore data easily if you are travelling to countries with no strong privacy laws
- If someone steals your device, they usually ask for your PIN so they can reset the device and sell it, this will not give access to your passwords if they are stored in a separate password manager
Conclusion
In the end, iCloud Keychain provides an adequate level of protection, and it’s much better using it than not using it.
But you should also keep in mind that all your passwords are safeguarded by a simple 6 (or even 4) digits PIN (unless you set a long alphanumeric password, but the majority uses a simple PIN).
You can use iCloud keychain for passwords that are not safeguarding anything valuable, but for the important stuff (banks, email access, etc) better to use a password manager.
