How reliable is the Compromised password capability in Safari

Question

How reliable is the Compromised password capability in Safari

I have attempted to action the compromised password messages in Safari, however I am not convinced it is providing reliable advice. Firstly, if Apple tells me that my password has appeared in a data leak and is compromised then I want to take that very seriously. However, it appears to have flagged everything and every password as compromised and so I am suspicious of the reliability of the feature. Admittedly, like most people, I do reuse the same password for multiple things as it is the only way I can remember my passwords. Are we saying that we need to use a different password for every application and site, while I understand that may be more secure it would likely mean I would forget most of my passwords particularly those I do not use as often.

The second issue is it seems that no matter what I change the password to, even if I put a random string it continues to tell me that it is compromised. Once again this suggests to me that it is not working and thus not worth following the advice which may not be accurate.

Again, I think the feature is great and I would like to use it but of the "Compromised password" reports are not true then it is not a useful feature.

Posted on Jul 11, 2022 04:43 AM

Reply

Answer 1

pjswiz

Level 5

5,424 points

Jul 11, 2022 05:05 AM in response to Richard from Sydney

Hello!

Lets start off at 1! You can learn more about the detection of compromised passwords here: Change weak or compromised passwords on iPhone - Apple Support. As a security graduate, I can tell you that yes using the same password for everything is really bad! All it takes is one password leak, which in this case happened, and all your accounts are now compromised. Good News! You don't need to remember long and complex password. iCloud Keychain does that for you! You can use iCloud Keychain as a password manager, it will even suggest strong, unique, and random passwords for you to use. All you need know is one strong and unique password (your Apple ID password) and iCloud Keychain will do the rest!

On iPhone:

Open Settings on iPhone
Scroll down and tap on Passwords
Authenticate

Now you can click on the "+" in the upper right corner to add new passwords. You'll need to specify the website, username, and password, but before you fill out anything just tap on the password field. Above the keyboard you'll notice a "Strong Password Suggestion" you can use. This will allow you to use strong and unique passwords. Better yet, when logging onto a website your phone will suggest signing in with his credentials! Preventing you from typing that password every time.

When you sign up for a website, and click on the password field, iCloud Keychain will suggest a strong password for you. After the sign up process you will be given a prompt to save this password in your Keychain. Oh and I forgot to mention, your iCloud Keychain is synced with all your devices! Sign-up for something on your Mac? You can still use those credential on iPhone to authenticate with a website.

Please read the following support pages:

However, it is worth mentioning that password may change very very soon. At WWDC 2022, Apple announced a new feature called "Passkeys." You can get a brief description from the screenshot below:

Please also read these support pages:

I don't want to try explaining it as it's a very complex and advance topic. If you have a chance I'd highly recommend just looking at what Apple and other companies are doing with Passkeys. I'm very interested to see where this goes.

Off to the second one. You need to make sure you're changing the password on the website as well. Then I'd recommend waiting for the system to update. I personally haven't had any compromised passwords, because I always use the iCloud Keychain suggested or very custom passwords I save in iCloud Keychain. I've had friends with no issues with this feature either who did have compromised passwords. I'd recommend just changing the passwords to strong, unique, and random strings (characters) both in iCloud Keychain and on the affected website.

Remember passphrases are better than passwords😉

I know I went into a lot of detail here, but please let me know if you have any further questions! I hope I answered everything!

Reply

Answer 2

Jul 11, 2022 05:25 AM in response to pjswiz

Thanks for the long response, I will go through it in more detail but some initial comments...

I don't use one password for everything, I have a large number of different passwords and Apple is telling me they are all compromised. I'm still not convinced. It has listed hundreds of sites and apps and claims they are all compromised.
You can edit the entry and and it refreshes the report, no matter what I change the password to it still says its compromised.
I find the Apple generated passwords problematic as I have had too many circumstances where I have used the Apple generated password and then found on subsequent use that it has not been saved correctly and I can't access what ever the service is that I used it for. Lets just say I used it to sign up to a web site and then needed to use it saved password to access an app from the same company and it does not detect they are related. Now unless I have a password I can remember then I am out of luck.
I will test this by changing a password to an apple generated one and see if it clears the message. I am suspicious it will still claim its compromised and the system has a bug.

While I understand your enthusiasm for Apple to be perfect, I am also a big apple fan, but in this case I am not questioning how they propose to improve security, I am asking if what they have built actually works.

Reply

Answer 3

pjswiz

Level 5

5,424 points

Jul 11, 2022 05:33 AM in response to Richard from Sydney

If you're questioning if you've been compromised, please use this site as well, https://haveibeenpwned.com. All it needs is your email or phone and it will search and see if your account is compromised. It'll also tell you what accounts and from what data breach.

To answer your point #3, if you don't see a prompt to "save" or "update" password from iCloud Keychain it won't save. Whenever it detects a log in form it'll do it's best, but I do agree there is sometimes where it cannot. However, most of the time when logging in website vs app and it doesn't detect it, you'll still be able to see the key icon above your keyboard. From there, you can view all your saved password and then auto fill.

I hope this helps!

Reply

Answer 4

Jul 11, 2022 05:49 AM in response to pjswiz

Thanks, the first password on the list of Compromised passwords is an AppleID password so I thought I would use Apple's longer auto-suggest password for that and to my surprise it did not pop-up with the long password suggestion. Kind of funny if one of the only sites that long auto-passwords do not work with is an AppleID :)

Reply

How reliable is the Compromised password capability in Safari

Similar questions