Apple Keychain as possible password manager

bsclifton commented 6 years ago

Carried over from https://github.com/brave/browser-laptop/issues/3226

The idea would be (on macOS) to integrate with Apple's Keychain and be able to use credentials stored there (similar to behavior from Safari)

jessecurry commented 6 years ago

This is the big barrier to switching for me at the moment. I use auto-generated passwords on most sites, having to switch into Keychain Access every time I login to a site is painful, and switching to a less integrated password manager would also be pretty painful.

BCtopics commented 5 years ago

+1 This is the main reason I can't fully switch over to brave.

Alex-GKy commented 5 years ago

+1 agree, really one of the last things left to make this the best browser experience on MacOS

Hermitter commented 5 years ago

+1 Would really love this feature. Are there any plans for this yet?

CodeWarriorr commented 5 years ago

+1

beegus commented 5 years ago

+1

samoclay commented 5 years ago

will this be included in any near future sprints?

bsclifton commented 5 years ago

cc: @tomlowenthal @rebron for prioritization

kwatsen commented 5 years ago

One clarification, keychain integration on iOS appears to be partially working already, with Brave v1.9.1 (19.04.02.12).

On iOS, when logging into a site, I am able to auto-fill my credentials stored in Keychain. Unfortunately, Brave prompts "Save login for for ?", to which one can hit "Don't Save", which is annoying and error-prone. Good news is that the "Save Login" prompt can be disabled in Brave Settings.

Being able to read (not write) passwords from Keychain is a reasonable user experience for now (being able to write to Keychain could come later). My wish is for Brave on MacOS (not iOS) to do the same. This issue blocks me from using Brave as my primary browser on MacOS.

samoclay commented 5 years ago

For Mac Desktop not iOS

On 8 May 2019, at 18:59, Kent Watsen notifications@github.com wrote:

One clarification, keychain integration on iOS appears to be partially working already, with Brave v1.9.1 (19.04.02.12).

On iOS, when logging into a site, I am able to auto-fill my credentials stored in Keychain. Unfortunately, Brave prompts "Save login for for ?", to which one can hit "Don't Save", which is annoying and error-prone. Good news is that the "Save Login" prompt can be disabled in Brave Settings.

Being able to read (not write) passwords from Keychain is a reasonable user experience for now (being able to write to Keychain could come later). My wish is for Brave on MacOS (not iOS) to do the same. This issue blocks me from using Brave as my primary browser on MacOS.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

sjurgis commented 5 years ago

This is my main blocker from switching from Chrome (and potentially Safari).

One thing to mention I kinda like about Chromes approach tho - deleting Profile (say terminating work with particular client) - permanently deletes their passwords too! So then I don't have to manually care about them.

SchroedersKater commented 5 years ago

Same here. I better not trust any new browser. The can tell a lot.

samoclay commented 5 years ago

Hey, what priority level is this? I love using Brave however my passwords are being duplicated in Brave password manager and having to copy over from Apple Keychain is a major chore.

Hultner commented 5 years ago

Hey, what priority level is this? I love using Brave however my passwords are being duplicated in Brave password manager and having to copy over from Apple Keychain is a major chore.

^This is my main reason for not switching to brave. 👍 Not having a keychain integration puts a major moat between me as a potential user and the brave browser.

samoclay commented 5 years ago

if this is super complicated, maybe an easier alternative could be adjusting the brave password manager (having it sync'ing on a brave private blockchain, Using a master key (mnemonic phrase), with an option to import/export passwords between brave-chain / apple key-chain.

venatir commented 5 years ago

+1. Cannot switch without this. At the moment I only use it from time to time and have to go and manually copy paste passwords. My password manager is keychain. Switching browser is easier than switching an os level password manager with nice syncing

regiryan commented 5 years ago

+1 was about to switch but the thought of manually pulling all my auto-generated passwords from keychain (entering the master password each time) is giving me anxiety

wmehilos commented 4 years ago

+1, switching browsers on Desktop is very much something I'm willing to do, but the inability to set default apps on iOS keeps me on Safari (just not worth the jank and headache trying to do something the OS doesn't really want you to do). Unfortunately, this means I'm very much tied to iCloud Keychain. My login password is something like 20 characters long. Having to type that in every time I need to grab one of my auto generated passwords for the multitude of websites I have accounts for is just too big of a headache. Brave is my jam, Safari on Mac is dead to me ever since 13.0, but without my iCloud Keychain, I'm stuck.

samoclay commented 4 years ago

Some light reading on Access control lists over at Apple developer docs might help with this. We would all be grateful if you could consider adding this to Brave

bodokaiser commented 4 years ago

+1

RobMaskell commented 4 years ago

Won't stop me switching from Chrome of Firefox, but will stop me switching from Safari

RyanBeckett commented 4 years ago

+1

mitjans commented 4 years ago

Any update on this feature request? Just tried to switch from Safari to Brave, the first thing I noticed is the lack of keychain integration. Would be awesome to have it!

oraichu commented 4 years ago

+1. Love the browser, but missing this feature.

sanket0354 commented 4 years ago

+1 - the integration will make a lot of difference for many people

wivern-co-uk commented 4 years ago

+1 - can't switch fully to Brave and have to use another browsers, which can move passwords across devices and platforms. @rebron, what we(community) can do to bump priority?

osarrouy commented 4 years ago

+1

originalgravity commented 4 years ago

Not having this is a barrier for me unfortunately

Demircivi commented 4 years ago

Same goes for me. I really like using Apple Keychain in Safari on my Mac and also on my iPhone. Since my passwords are stored in it I never think about changing it since no browsers(Chrome, Edge, Firefox, ...) support keychain including Brave.

rilaby commented 4 years ago

Throwing out a comment just to upvote on the importance of the feature.

duvrai commented 4 years ago

Won't work that way

This issue's title says Apple Keychain as possible password manager? I suppose the question is about Brave sharing passwords with Safari in the Keychain. But I think it won't work that way. If I'm right Apple doesn't want anything to access Safari's passwords in the Keychain, they do encourage alternative password managers.

Export passwords from Apple Keychain?

Is it even possible for anything other than Safari to access its passwords? The only evidence I could find (recommended by 1password) is an applescript that will copy/paste usernames/passwords from the Safari UI one by one to a csv file. This is probably unsafe. It's also an ugly and slow process and it might of course be blocked in future Safari updates. But it seems the only migration solution for the moment.

Switching to Brave from Safari

While reading the above comments, it's clear that people use iCloud to sync their keychain between devices. In that case, a one time export of passwords would also mean you need to switch to Brave on all your devices to continue to be able to read/write new passwords. Luckily this will become possible in iOS 14 since it will finally let us change the default browser.

Brave saved passwords as an iOS autofill provider

On iOS, instead of Brave accessing (Safari) passwords in the Apple Keychain, Brave should provide its passwords as an AutoFill provider (brave/brave-browser#36028). (Firefox did exactly this with Lockwise.) This way saved passwords in Brave would not only be accesible to Safari on iOS and vice versa, but AutoFill would also work between websites and their iOS apps (using their corresponding domain).

Password generator

Again summarizing what people said above: people using Safari's password generator won't switch without this functionality. (Quite frankly integrated password generators should be security 101, right?) Currently there is no password generator in Brave: brave/brave-ios#4901

Brave Sync v2

Another side note is that Brave itself has its Sync features currently disabled. Sync will be coming back as Sync V2 (#9989) in Brave 1.12 which is currently planned for august 2020

StefanLobbenmeier commented 3 years ago

~~I think this issue can be closed now, Apple released a chrome extension for that that Brave users should also be able to install:~~

~~https://www.macrumors.com/2021/02/01/apple-chrome-extension-icloud-passwords-windows/ https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en-GB~~

As was pointed out by commenters below, it does not work on macOS and also does not fix the issue

danjohnson95 commented 3 years ago

@StefanLobbenmeier that extension is for Windows only

kwatsen commented 3 years ago

And, besides, the goal is not to reach out to the cloud, but rather to the local Keychain on the MacOS system Brave is running on...

StefanLobbenmeier commented 3 years ago

that extension is for Windows only

I see, I misunderstood that sentence from the MacRumors article:

‌iCloud‌ Passwords is available now in the Chrome Web Store for both Windows and Mac.

While it is technically true, it does not work in my Brave on macOS:

So my bad, thanks for correcting me @danjohnson95

openxthinking commented 3 years ago

I use brave on iOS and it's suggesting passwords from Apple keychain. I'd like to see this behavior on macOS as well. At the moment I've to enter passwords manually on desktop, it's very inconvenient. I've to enter them manually because I don't have much trust in Browsers keeping my passwords save. Just like I don't trust metamask as my main wallet.

cyberfunk commented 3 years ago

I agree 100% I love the way Apples password manager integrates so nicely on iOS with Brave (and every other App) and it just so happens that Brave desktop and mobile passwords do not sync on iOS so Apple really takes care of things on iOS with Brave! Looking forward to having one password manager across all devices. Apple is my ecosystem for the foreseeable future so I hope desktop integration comes sooner than later.

UPDATE: Pulled the plug on both Apple Keychain and Brave Password manager and consolidated everything to Bitwarden. The integration on iOS is close/similar to Apple Keychain and the desktop experience with the Bitwarden extension for Brave is excellent!

imdatceleste commented 3 years ago

My EUR 0.02: I like Brave, it is a great browser and yes, like all the others before me, I would like to use Brave as my default browser on macOS. But I can't do this for the same reason as all the others: missing Keychain-Intefgration.

The problem is that I have probably hundreds of passwords in my keychain and I do NOT want to move them to Brave; I want to leave them there, synced via iCloud to my iPhone, iPad, and all my other macOS-machines (I have three).

Also, from time to time, I want to be able to use Safari for whatever reason. What I want is easy: I want my passwords available across all browsers, inline WebkitViews within apps (e.g. for oAuth2-Authentications) WITHOUT having to move them around myself OR without having to by an additional password manager (after all, Keychain is meant to be that password manager).

Until Brave has this feature, I can only use Brave for exception when Safari absolutely doesn't work on a website. Pity...

cyberfunk commented 3 years ago

Hello I recommend Bitwarden as your new FREE open source password manager. I turned off iCloud Keychain and only use Bitwarden in Desktop macOS and iOS and it works as well as Keychain. I had to get rid of Safari as it’s broken with a few important websites I use. Brave works with everything plus MetaMask as well which Safari does not support.

cyberfunk commented 3 years ago

@imdatsolak Why the downvote? Bit-warden basically solves your issues at least in the short term.🤔 Btw I do not work for and am not affiliated with Bit-Warden in any way.

imdatceleste commented 3 years ago

@cyberfunk because I already explained above why I don't want to use another password manager. This would, again, require me to use TWO different password managers - Keychain and BitWarden. The fact is that I use Keychain for many, many solutions/apps and all of those would need to support BitWarden instead of the standard system-API.

The downvote was because you already had mentioned BitWarden before, I then explained why using a second password manager is not an option for me and you came back again with BitWarden :-)

lil5 commented 3 years ago

👎 This promotes a non-free Apple service. There is an extension for this.

https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj

SebastienElet commented 3 years ago

@lil5 this extension is not working on MacOS ATM.

Haravikk commented 3 years ago

Won't work that way

This issue's title says Apple Keychain as possible password manager? I suppose the question is about Brave sharing passwords with Safari in the Keychain. But I think it won't work that way. If I'm right Apple doesn't want anything to access Safari's passwords in the Keychain, they do encourage alternative password managers.

Safari stores passwords in a keychain, and any iOS/macOS app can request access to passwords stored in a keychain. However, if they're not the app that created the entry, the user will be asked to confirm access (Deny, Allow or Always Allow), with the latter option giving the app permanent access to that keychain entry.

I believe there's also an entitlement that allows an app to request stronger access to keychain entries (so you don't need to be prompted for every single one), but personally I'd be fine with the individual prompts.

Add me to the long list of people who would like to see native password integration; it's currently a mark against Brave on macOS, which is otherwise excellent.

kupietools commented 2 years ago

3 years later, is there any news on whether this will be included or not? Badly missing it.

imdatceleste commented 2 years ago

👎 This promotes a non-free Apple service. There is an extension for this.

https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj

Please re-read the whole discussion: we are talking about a solution for macOS, not Windows (your link) and also not an Apple service (as you say).

The extension you mention has already been mentioned way above in this thread;
The extension you mention is Windows only;
and no, it doesn't solve the problem described here.

We are not asking to support "a non-free Apple service".

We are asking for an integration with a macOS-Feature (the Keychain-Library/-Framework/-Database) which was already available with macOS 9(!) around the turn of the millenium.

If you are not a user of a specific platform (here: macOS), please refrain from commenting on topics related to the respective platform.

FullStackAlex commented 2 years ago

Check out this thread and answer to (better) understand why this feature is not possible / not available: https://community.brave.com/t/mac-os-keychain-integration/54353/6

FullStackAlex commented 2 years ago

Still wonder though, why they don't check this GitHub Issue at all..

Haravikk commented 2 years ago

Check out this thread and answer to (better) understand why this feature is not possible / not available: https://community.brave.com/t/mac-os-keychain-integration/54353/6

While this is interesting, I'm not sure that the conclusion on the Chrome issue is correct; while app store apps are required to declare their entitlements, an app does not need to be distributed through the app store to declare entitlements. Any signed app can now be sandboxes, and should be able to request the keychain-access-group entitlement.

Also, even without this entitlement it's still possible to use the Keychain to store passwords; you only need the keychain-access-group if you want to access/manipulate passwords stored in the iCloud (local items) keychain. If a user isn't using iCloud keychain then these passwords are still shared with other keychain enabled browsers. iCloud keychain isn't enabled by default, even with iCloud enabled, and I don't use it personally as I find it a pain in the arse (just generates loads of conflicting passwords and headaches in my experience).

FrancoCorleone commented 2 years ago

We're half way into 2022. Any updates on this? I'm struggling with full migration to Brave just because of that feature

brave / brave-browser