Hacker News new | ask | show | jobs
by filleduchaos 2171 days ago
"How am I supposed to use a password manager if I can't put my plaintext password in a file that everyone can access?"

Like I have already said,

>> Developers especially really should be promoting the use of named and/or private clipboards (and of the share sheet in Android and iOS).

And for the specific case of a password manager, iOS offers Password Autofill integrations. It's not the OS's fault if developers are too lazy to use the right tools for the right job.
1 comments
manquer 2171 days ago
iOS does not offer auto fill for third party password managers and there is no unified service that Apple offers for web and desktop and works across OS and multiple browsers . So it is less to with developer laziness and more to do with lack of usability beyond iOS
link
filleduchaos 2170 days ago
> iOS does not offer auto fill for third party password managers

Yes, it does - see the section very literally titled "Integrate a Password Management App with Password AutoFill" at https://developer.apple.com/documentation/security/password_....

But again, many devs don't actually keep up with and/or look up the proper way to do things on the platform they're deploying on.

> and there is no unified service that Apple offers for web and desktop and works across OS and multiple browsers

Apple has a duty to its own software. Why exactly is the onus on Apple to offer a magical grand unified service instead of on third party software developers to actually take the time to study and use the appropriate tools on each platform they want to deploy on?

If you want things to be secure you generally have to put in the work for it. 1Password spends resources building & maintaining browser extensions to integrate directly with input fields - why doesn't your password manager of choice offer similar? As a developer one could use named and/or private clipboards to actually have control over when and how the data their users clip is accessed - why not do that over complaining that a shared, global buffer that applications can access programmatically by design is, while convenient, also not exactly the most secure way to transmit sensitive data?

link