The Practical Guide To Mac Security: Part 3, Password Managers

[@annh1917]

... very clear & concise - these tutorials on passwords have clarified most all of my confusion around compromises. With computers, if I understand the bigger picture, then I am more capable to address things more effectively & strategically for my purposes. Many thanks!

[@matthewcarpenter4716]

Gary thank you for starting this short course. As of yesterday I started to look at my Keychain and there were several warnings, including passwords that have been involved in data breeches?! I have been systematically changing anything with a yellow triangle and exclamation mark in my Keychain.

[@hermes8258]

03:37 I just tried to follow along. I have a MacBook Air. I went to Safari. No such thing called 'preferences'. Instead it is called (now anyway) 'settings' and the default for me is 'general'. Click instead in 'passwords' and go one more step, clicking on 'passwords'. Now, it is smooth sailing

[@johnshepherd5673]

Thank you for your helpful videos. I have been using key chain and safari. An issue I’ve had is when I delete old passwords from the password list and export the updated list to a csv file they magically reappear which is very frustrating and it would appear to be a common problem. Any advice or a short video on how to sort this would be most helpful. Thank you once again.

[@macmost]

I haven't experienced that. Not sure why it doesn't delete. But is seems like a minor problem, right?

[@johnshepherd5673]

@@macmost thank you. Google it there is stuff on that. Think it’s to do with safari speaking to keychain then deleting in one place,it immediately gets updated from the other. Very frustrating. What is even stranger I enabled a 3rd party app Dashlane, disabled using keychain from password options, exported Dashlane to csv, yet old deleted passwords still appeared in the exported csv file? I’m confused-com lol. Beyond my pay grade lol 👌👌

[@KingMoeJo]

Just freidnly reminder that the new Password Manager feature in System Preferences is only avaliable in the new macOS Monterey, which is still not available until this fall; Yet, it's svaliable in Safari browser.

[@brentmcinnis7316]

Thank you for this info. I was quite confused as to why I couldn't find the Password Manager in System Preferences in macOS Big Sur!

[@desertpatient]

This has been a scary change since I first watched you other series....but we have pretty much made the change. It would be nice if we could have a print out of the passwords....Thank you

[@dsbennett]

Check out Keeper. I've been using it for a year and I love it. I can export the database to a spreadsheet which can then be opened in Numbers and printed. I recently moved, so I added a field to Keeper specifically for my address. I use it to keep track of which accounts I have updated my new address. I only have 162 accounts, so this shouldn't take more than a month. 😳 With Keeper, when I change or create a password on my laptop, it is automatically updated on all my other devices, including my Android phone.

[@jimtucker8183]

Hi Gary, another great video! Question, Safari doesn't immediately approve the extension for one of the password managers you recommended and states they "can read sensitive information from webpages, ... including credit cards. Can alter the appearance and behavior of ...all webpages". My assumption is that this is OK to allow since they would need this access to store my passwords for me. I thought I would double check before I granted approval for the extension on Safari. Thanks again Gary!

[@macmost]

Yes. It needs to of course in order to operate. So it is up to you to trust the developer of the app first, before deciding to use it.

[@loisskiathitis8926]

A very helpful video tutorial today! Thank you for the visuals. Thank you, Gary! 👏👍🏻❤️

[@reallifelegend4781]

Hi Gary. And thank you again for all the help you give us. However, according to an Apple representative, the built-in password manager only autofills in Safari. It doesn't not perform anything outside of Safari. For that we would have to copy and paste into other browsers and or apps on our Mac computers. (I doubt that's the same with phone and ipads, but my only need is for the Mac). Have you any knowledge about whether this is incorrect?

[@macmost]

Not true. Third-party apps can use this. So it depends on the app. If you find that the apps you rely on don't yet work with Apple's system, then a third-party password manager may be your best bet, as long as that app supports it too.

[@IRVremy]

Enpass works great for me. I'm a legacy user so I have it for all my devices both Apple and Windows and don't have a subscription.

[@qnnnp]

Thank you for your videos! I have a question that is connected to the security topic. Some people blurring the serial numbers of their Macs (for instance on tutorial videos). Does It make any sense to do it? It seems that this information is harmless, but maybe I am missing something.

[@macmost]

It isn't that important. The only downside to showing your serial number is that people could use a "valid" serial number is scam online for-sale ads. But it isn't like they couldn't get serial numbers from a variety of sources anyway.

[@qnnnp]

@@macmost Thanks!

[@sherazsiddiq]

Thank you Gary. Is there a way to export safari passwords as a csv file?

[@macmost]

That's a new feature coming in Monterey.

[@dsbennett]

Keeper lets you export the database to a csv file, and you can have it on all your devices.

[@allumpfa]

This video made me take a good look at how badly I manage my passwords. I started updating my passwords using the strong ones provided which works fine in safari but got into a mess when accessing the same thing on an IOS app e.g. instagram on iMac and via app on iPhone. How would you go about getting the two in line with one another?

[@macmost]

Keychain should stay in sync if you are using iCloud.

[@debreale5236]

Very helpful! Much obliged, Gary. 😊

[@doyourbest7655]

Thanks Gary, I wanted to share a prospective from a senior user. That is that the password programs may be great but how secure are They from hacking via any source like through your iPhone or iPad when used in the wild? The concern there is that since the passwords are shared among your devices, the logic flows that your critical information could be compromised through that device. Second when the password program collapses and you have extensive password size, can a person actually use your computer again to get immediate and necessary work done without delay. Who among us has not been locked out of their own car when it was critical to get somewhere. Thank you for simple and straightforward explanations relating to security, thus lifting the fog and concerns of using the computer. Many my age will not use the internet for their financial transactions because of the perceived risk of compromise and loss. Just sharing so you might have a useful outline of discussion in future videos. Thanks again

[@macmost]

For someone to get to the passwords on your device, they need two things: physical access to your device and your passcode. The first is impossible for a typical hacker to get as they aren't near you. They are probably in another part of the world. The second would protect you in case someone near you steals your device and wants to take their crimes even further. But then you can use Find My to disable it at that point too (coming in a future lesson). What would be far far easier is for someone from somewhere else to break into your accounts if you use a weak password. Not sure what you mean in your second point. Collapses?

[@raymakara]

So, if I use Chrome as my web browser, and I'm not currently on Monterey, I would have to use a 3rd party pwd manager, correct?

[@gofft1355]

Gary, I'm retired army and retired DOD and some sites require us to change every 90-120 days and require special characters and a specific length. Is there a way to change the way Mac generates a password?

[@macmost]

That's an old outdated practice that they should have replaced with two-factor a long time ago. There's nothing you can do in Safari to deal with it other than edit the password provided to stick to those rules. But this practice hopefully will disappear.

[@orestesdd]

However, I don't use Safari. Instead, I use Google Chrome, and I don't like my passwords to be store somewhere on the net, I would prefer to have a software on my Mac or PC where I can keep all my passwords. Do you have any suggestion for the Mac as I already have a software for my Windows PC? Thank you for all your videos.

[@macmost]

Sounds like you want to use a password manager, but select to only store the passwords locally. That makes it hard to do things though, as logging on using another device would mean manually typing the password.

[@orestesdd]

@@macmost It may be hard to do things, but I don't trust to have my password either on the browser or the cloud; thus, I prefer to do it manually. Thank you for your prompt feedback.

[@robhall2919]

Will iCloud Keychain let me choose a strong password and save this password for an Apple ID password?

[@debreale5236]

Thumbs up! Thank you, Gary!

[@ralphhenson3192]

Thanks. I use Chrome since my place of employment uses gmail. Can I access the passwords generated by Safari on my 2011 iMac when I'm using Chrome? That's why I haven't used Mac's passwords so far. I appreciate all you have taught me.

[@macmost]

You can access them in Safari, and is macOS 12 you'll be able to get to them in System Preferences. But if you are using Chrome you probably want to use a third-party app like 1Password.

[@dsbennett]

If you subscribed to Hacker News, you would dump Chrome really fast.

[@basilbcf]

The only special character that seems to get used when Safari generates a "strong" password is a dash. Is there a way to make Safari use other special characters when it generates a password?

[@macmost]

There are no settings, no.

[@basilbcf]

@@macmost Thanks. That's kinda what I suspected. Too bad.

[@cauldron11]

I have seen a tutorial video where it is said that Mac users should not install an antivirus as the MacOS already has one built-in. With the XCSSET malware targeting some applications and Chrome (I use it as some websites require it), should I be worried and install an antivirus?

[@macmost]

Same thing applies here. In fact it was reported that Apple updated XProtect on the Mac to protect against this one before anyone else.

[@skybear400]

I have Big Sur and don't see the Passwords icon in System Preferences. Did it get moved?

[@macmost]

As I point out in the video, that's part of macOS Monterey, coming this fall.

[@robertblack7610]

Are strong passwords saved in "passwords? in iPhone; iPad and Mac Air ?

[@macmost]

Settings, Password on iOS and iPadOS. But in Safari on a MacBook Air.

[@petedonaghyguitar]

I just went through and changed a ton of my passwords using the suggestions from safari and my Mac is not remembering most of them! I'm screwed! Very frustrating!

[@iankastelic881]

Thanks, Gary!

[@hemangbakshi9501]

Isn’t Safari/keychain password “management” risky if the device is lost or stolen as there is no concept of master password to use safari passwords unlike 1Password where unless one logs in with master password into 1Password, it wont automatically use passwords on websites/apps?

[@macmost]

There is a master password: your user account password. If you lose your Mac, someone can't get to your passwords, or any part of your Mac at all, without your account password.

[@petedonaghyguitar]

So I keep changing my passwords using the Mac suggestions and my Mac won't remember them. Essentially locking me out of a lot of accounts. What am I doing wrong? There doesn't seem to be an option to have Safari save these new passwords. It doesn't save them in Safari preferences like it does for some of them. Any ideas?

[@macmost]

If Safari is giving you suggestions by filling in the password, then it should be remembering them too. Try searching in your passwords to see if maybe you have more than one for that site now?

[@petedonaghyguitar]

@@macmost I look for the passwords in the Safari preferences and it usually says: not saved. I would say one out of Avery 4 passwords I've created or changed is saved. Very strange.

[@michaelseavello4612]

What should we do if a website rejects the suggested password (does not meet their requirements(?

[@macmost]

If a website has bad security and it rejecting a password for being too long or using some characters, just use the password as best you can, maybe removing some characters manually.

[@davebullock3517]

Gary, how do I use this for Apple ID?

[@macmost]

If logging into website, like iCloud.com, then it should work. But for other places it is best to memorize that particular password since it is the key to everything.

[@davebullock3517]

@@macmost, ok, thanks!! Great video series on security

[@cmphillips1968]

I am trying to use safari password manager for my bank but it keeps saying it only accepts 6 to 8 characters, my bank is one of the main ones I want protected..please help :)

[@macmost]

That's horrible of them. Of all places, a bank should know better than to limit password length like that. You are just going to have to manually set the password using the first 8 characters of a random one.

[@cmphillips1968]

@@macmost Thank you

[@joehalldorson6488]

I have Big Sur and don't have Passwords in System Preferences?????

[@macmost]

That is for Monterey, not Big Sur. Coming this fall...

[@joehalldorson6488]

@@macmost confusing!!

[@OldDirtyMors]

The question is, how safe is iCloud?

[@macmost]

Do you mean in terms of securing your passwords? Apple has tons of information on that if you look. Start here: support.apple.com/en-us/HT202303

[@hanskutube]

You didn’t really cover how to fill in your login id that you use for a browser on your mac then you want to login in to their app on your iPhone/iPad.

[@dcwilhite]

If you use the Safari password manager, those passwords should also show up in the saved passwords on your iPhone and iPad. Check Settings > Passwords on those devices.