Passwords permeate our lives. With an ever-growing number of sites, services, and apps to log into, people need help generating, managing, and accessing them. There are excellent third-partyapps that can help, but the reality is that most people aren’t going to download a third-party app, and even fewer are likely to pay for one. That’s why Apple’s work with passwords is so important.
However, what makes that work impressive is the lengths to which the company has gone to make good password practices easy for users. The password updates to iOS 17, iPadOS 17, and macOS Sonoma are fantastic examples, making it easier than ever to share passwords and for users to begin adopting passkeys, a superior method of authentication compared to traditional passwords.
Today Apple and Google jointly submitted a proposed industry specification to help combat the misuse of Bluetooth location-tracking devices for unwanted tracking. The first-of-its-kind specification will allow Bluetooth location-tracking devices to be compatible with unauthorized tracking detection and alerts across iOS and Android platforms. Samsung, Tile, Chipolo, eufy Security, and Pebblebee have expressed support for the draft specification, which offers best practices and instructions for manufacturers, should they choose to build these capabilities into their products.
Apple says that the spec, which has been submitted to the Internet Engineering Task Force (IETF), incorporates input from device manufacturers as well as safety and advocacy groups.
Erica Olsen, the National Network to End Domestic Violence’s senior director of its Safety Net Project, said of the companies’ efforts:
This collaboration and the resulting standards are a significant step forward. NNEDV is encouraged by this progress. These new standards will minimize opportunities for abuse of this technology and decrease the burden on survivors in detecting unwanted trackers. We are grateful for these efforts and look forward to continuing to work together to address unwanted tracking and misuse.
Today, 1Password announced that it’s moving to a passkey-based system for unlocking its password manager app. Using a password manager like 1Password already means not having to remember passwords for every site and service you use because it locks your passwords behind a single, hard-to-guess password. With passkeys, that single password approach will become a thing of the past, allowing users to access their passwords through biometric-based passkeys generated locally on their devices.
1Password’s new passkey feature is coming this summer. The company explains how passkeys differ from the way the app works today:
Now, unlocking 1Password without a password is nothing new. It’s something we do every day using biometrics. 1Password was the first third-party iOS app to offer Touch ID, all the way back in 2014, and since then we’ve added support for Face ID, Windows Hello, Android Fingerprint, and more.
But as convenient as biometrics are today, they don’t actually replace the password; they only mask it. That’s why 1Password asks you to type in your password periodically in order to ensure that you have it memorized.
Passkeys also use biometrics, but they allow us to go farther and eliminate the underlying password entirely.
By replacing passwords with passkeys, 1Password will be able to preserve the benefits of biometrics while eliminating the need to ever use a password to access the app’s data, no matter what platform you use.
Passkeys are a big deal for security. The apps, sites, and services you use may not adopt passkeys for a while, but with 1Password doing so, the passwords you still need to use will be protected better than before. I know I’ll be switching to this system as soon as it’s available.
Last year, Apple proposed software for the iPhone that would identify child sexual-abuse material on the iPhone. Apple now says it has stopped development of the system, following criticism from privacy and security researchers who worried that the software could be misused by governments or hackers to gain access to sensitive information on the phone.
Federighi told Stern:
Child sexual abuse can be headed off before it occurs. That’s where we’re putting our energy going forward.
Apple also told The Wall Street Journal that Advanced Data Protection that allows users to opt into end-to-end encryption of new categories of personal data stored in iCloud, will be launched in the US this year and globally in 2023.
For an explanation of the new security protections announced today, be sure to catch Joanna Stern’s full interview with Craig Federighi.
First, iMessage Contact Key Verification allows users to verify that they are communicating with the person with whom they think they’re communicating. The feature will alert users who use it if someone has infiltrated cloud services to gain access to the user’s iMessage conversations. For even greater security, users can compare a Contact Verification Code in person, on FaceTime, or through another secure channel.
Second, Security Keys lets users adopt hardware security keys when logging into their iCloud accounts. The new system is an enhancement over two-factor authentication because it prevents someone from obtaining a your second factor through a phishing scam.
Third, Advanced Data Protection for iCloud adds encryption on the iPhone, iPad, and Mac for a long list of data categories. According to Apple’s press release:
iCloud already protects 14 sensitive data categories using end-to-end encryption by default, including passwords in iCloud Keychain and Health data. For users who enable Advanced Data Protection, the total number of data categories protected using end-to-end encryption rises to 23, including iCloud Backup, Notes, and Photos. The only major iCloud data categories that are not covered are iCloud Mail, Contacts, and Calendar because of the need to interoperate with the global email, contacts, and calendar systems.
Apple says that iMessage Contact Key Verification will be available globally in 2023, and Security Keys is coming early 2023. Advanced Data Protection for iCloud is available in the US today for participants in Apple’s beta OS program, and will presumably roll out with the next point release to Apple’s OSes.
Over the years, I’ve shared family photos with my wife Jennifer in three ways: iMessage, AirDrop, and Shared Albums. However, of those, iMessage won hands down, not because it’s the best way to share photos, but because Messages is an app we already use every day to communicate. Plus, sharing photos with Messages is easy whether you’re already in the app and using the Photos iMessage app or in the Photos app itself and using the share sheet. From conversations with friends and family, I know I’m not alone in my scattershot approach to sharing photos with my family.
It’s into that chaotic, ad hoc mess and all of its variations that users have improvised over the years that Apple is stepping in with iCloud Shared Photo Library, its marquee new Photos feature for iOS and iPadOS 16 and macOS Ventura. And you know what? It just works.
The feature lets anyone with an iCloud photo library share part or all of their photo library with up to five other people. Once activated, a new library is created that sits alongside your existing one and counts against the iCloud storage of the person who created it.
One critical limitation of iCloud Shared Photo Library is that you can only be a member of one shared library, a restriction that is designed to limit the library to your immediate household. That means I could share photos with my wife and kids because there are fewer than six of us, but I couldn’t set up another library with my siblings or parents for our extended families. Nor could I invite one of my extended family members to use the extra slot I’ve got in my family library unless they were willing to forego being part of any shared library their own family created.
Unwinding a shared library.
So, what do you do if you’re in a shared library and want to join a different one? There’s a button in the Photos section of Settings to leave a library, so you can do so with one tap, saving all of the photos in the shared library to your personal library or keeping just those you originally contributed to the shared pool. Deleting libraries is possible too, but only by the person who created them, who is given the choice of keeping all images or just the ones they contributed when they do so.
If this rings a bell, it’s because the passwordless technology announced today was first covered by Apple at WWDC 2021 when the company released a technology preview to developers to start implementing the tech into their apps and websites. The goal of passwordless sign-ins is to make sign-ins more convenient and secure by eliminating password management. Instead of passwords, sign-ins for apps and websites will happen through face, fingerprint, or device PIN authentication and eliminate the need for the use of one-time passcodes over SMS.
Apple, Google, and Microsoft already have FIDO Alliance standards built into their devices, but with the expansion announced today, the system will make authentication easier for users. According to the companies’ joint press release:
Allow users to automatically access their FIDO sign-in credentials (referred to by some as a “passkey”) on many of their devices, even new ones, without having to reenroll every account.
Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.
Just as we design our products to be intuitive and capable, we also design them to be private and secure. Working with the industry to establish new, more secure sign-in methods that offer better protection and eliminate the vulnerabilities of passwords is central to our commitment to building products that offer maximum security and a transparent user experience — all with the goal of keeping users’ personal information safe.
With the number of devices in our lives today and the use of multiple platforms by many people, those two changes should go a long way to making passwordless sign-ins easier to use. As good as password management apps and OS-level tools have become, juggling passwords for hundreds of websites and apps is a burden on consumers, which often leads to password reuse and other insecure practices. The FIDO Alliance’s standard promises to change that, and with Apple, Google, and Microsoft on board, the likelihood that we will see a more secure, passwordless future is better than ever.
This user guide is a personal safety resource for anyone who is concerned about or experiencing technology-enabled abuse, stalking, or harassment. It can help you sever digital ties with those you no longer want to be connected to and outlines the personal safety features that are built into Apple devices.
In addition to accessing the Personal Safety Guide on Apple’s website, it’s available as a downloadable PDF.
Regarding AirTags and other Find My accessories, Apple’s guide explains what the device’s alerts mean, providing users with the context necessary to know how to respond. The guide also offers suggestions of what to do if an unknown device is following them.
It’s good to see Apple’s Personal Safety Guide actively maintained. Apple has built-in safety measures for devices like AirTags, but it’s equally important that users know how to take advantage of those safety features, which the Personal Safety Guide should help with.
The problem of AirTags being used to stalk people has been in the news ever since they were released last spring, but a recent story in The New York Times has brought the issue to the forefront again. AirTags are fantastic when used as intended to keep track of your keys, luggage, and other personal items, but stalking is a serious problem that Apple should do everything it can to prevent.
Apple is also in a unique position given the vast size of its Find Me network. That puts the company in a different league than competitors like Tile, which carries greater responsibility with it.
In a story on Peer Reviewed, Matt VanOrmer puts a finger on something I’ve been wondering for a while: Are AirTags contributing to the problem of stalking or merely making us more aware of it because of the unique stalking countermeasures built into the device? It’s a classic causation/correlation question that is worth reflecting on. As VanOrmer explains:
I think the increase in news stories about AirTag stalking situations are less indicative of AirTags causing more stalking, and more indicative of how frequently stalkings already occur — with AirTags’ anti-stalking features simply bringing more of these horrible situations to light. These stories may be a classic example of the Baader-Meinhof phenomenon (AKA the “Frequency Illusion”) — in which increased awareness of creeps using AirTags to stalk women creates the illusion that it is happening more often, or even that AirTags are responsible for this illusory increase in incidence.
As VanOrmer rightly points out, Apple should do everything it can to prevent AirTags from being used to track people, which includes improving the tools available to Android users for whom Apple has made an app that is generally viewed as insufficient. This is also a topic where some added transparency about what Apple is doing to address concerns about stalking would help observers decide whether it’s enough instead of having only anecdotal news reports to go on. However, given the wide-reaching impact of the Find My network, which affects people who aren’t even Apple customers, I think a third-party audit of how Apple is handling the security and privacy implications of AirTags is warranted.
