iOS Upgrade Process - Email Account Passwords : iCloud Keychain versus 1Password

Kurtois

There are many threads returned when you search this forum regarding "iCloud Keychain". I would like to make my question more specific.

In the process of upgrading from iOS 9 to 10, my experience was that several of my Gmail account passwords will have to be re-input for Gmail accounts setup in iOS. Multiply that by the number of iOS devices I have, and I will need to spend some time with each iOS device. With that in mind, I have not setup all accounts on all iOS devices, however, it would be nice to do so. I suspect that by using a combination of email account sync'ing in iCloud and storing the passwords for these Google accounts in the iCloud Keychain, I will save myself that labor.

I do hesitate to do this, however, as I do not like having my passwords in more than one spot. Is there any way to save myself pain of re-inputing these passwords on each iOS device by using 1Password alone?

I am open to any and all suggestions here. I look forward to input from AgileBits staff.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Dropbox

Drew_AG

Hi @Kurtois,

Thanks for reaching out to us about this! It certainly sounds like a lot of work to have to re-enter your password for each Google account on each iOS device. I didn't have any problems like that when I upgraded my iPhone to iOS 10 though, so hopefully you won't run into the same problem on your other devices.

If I understand, your question is if 1Password can make it easier for you to sign into each Google account? If so, and if you're already using 1Password on your iOS devices and have all your Google login information in 1Password, then yes I think it should definitely make it easier. 1Password won't be able to automatically populate the Google password field, but you should be able to copy & paste each one from 1Password into the Google account settings.

I'm not sure if that answers your question, though. If I misunderstood, please let us know. Thanks! :)

Kurtois

Thank you for the response, @Drew_AG. Let me back up a bit and maybe repeat myself in a more bulleted way.

I have several Gmail accounts. I have several iOS devices. Only on my iPhone do I have all Gmail accounts defined with their associated passwords. That leaves me three other devices to define these Gmail accounts on.

On my iPhone w/ iOS 10, after the upgrade, the stock email app prompts me for each Gmail's account password. So, I must go to 1Password, lookup the password, copy, go to Apple iOS mail, paste. Repeat as needed.

With the above in mind, I think 1Password can only serve as reference for my Gmail passwords. It does not have access to the resource(s) to automatically input the password into the password field for my defined Gmail accounts within Apple's mail app.

This sort of leaves me with using an iCloud Keychain solution. I think. So, I could save my email configuration/credentials in the iCloud Keychain and minimize configuration time on the other iOS devices. At least, that is my thought.

That said, I guess I am coming to a 1Password forum for an iCloud Keychain question. However, I would suspect you are hit with a question about iCloud Keychain regularly and may have insight to share.

Ben

@Kurtois,

Thanks. I understand the question.

However, I would suspect you are hit with a question about iCloud Keychain regularly and may have insight to share.

While I could see where that idea might come from, it is not the case. I'm one of the folks on our team primarily responsible for technical support on 1Password for iOS, and I can't remember the last time someone asked me about iCloud Keychain. As I use 1Password for just about everything I have very limited exposure to iCloud Keychain. I do use it to store a couple of passwords that I consider to be low security but my usage doesn't cover your question, unfortunately.

With the above in mind, I think 1Password can only serve as reference for my Gmail passwords. It does not have access to the resource(s) to automatically input the password into the password field for my defined Gmail accounts within Apple's mail app.

That is correct. 1Password cannot fill into Apple Mail or the Settings app (iOS does not allow password managers to do this).

I wasn't aware iCloud Keychain could address this either.

This sort of leaves me with using an iCloud Keychain solution. I think. So, I could save my email configuration/credentials in the iCloud Keychain and minimize configuration time on the other iOS devices. At least, that is my thought.

Again I wasn't actually aware iCloud Keychain would do that. I have iCloud Keychain turned on, and have stored a couple of items in it. I also have a number of Gmail/Google Apps accounts configured. I was still prompted for the passwords, the same as you experienced.

If you do end up trying this I'd be interested to hear how it turns out.

Ben

Kurtois

@Ben - I have intentions of enabling iCloud Keychain and will report back on how that went. However, I did want to add to this conversation a reference on Apple's support site. After reading it, I am scratching my head a bit on why 1Password does not already take advantage or iCloud Keychain. They seem like complimentary offerings, in some respects. To that point, I pull out this Q/A:
"Does iCloud Keychain work with third-party apps?

Yes. Developers can update their apps to work with iCloud Keychain. Passwords saved by those apps are kept up to date on all devices that use the app and are using iOS 7.0.3 and later or OS X Mavericks 10.9 and later."

From what I gather, iCloud Keychain has been around since several years back (iOS 7 and OS X Mavericks 10.9). It would be interesting to know why 1Password does not support integration with it up to this point.

AGKyle

Hi @Kurtois

Ben asked me to follow up with you on this as a member of our iOS development team and also a member of our security team. I think this is actually going to fall more into the iOS development side than the security side though :)

Yes, developers like us can integrate with iCloud Keychain to store only our items. When an app stores an item in the iCloud Keychain it is limited to that application only. In other words, other applications cannot read what we put there and we cannot read what other applications put there. There are a few exceptions to this I think in that Apple can access some items from various apps, notably for items setup with universal logins, or whatever that feature is called that allows Safari to save an item (or an app) and then the item can be used across those two as long as the app defines the URL and has a file on the server that confirms the relationship.

So, I don't think if we stored any of our data in iCloud Keychain that Apple would be able to access it for the purpose of logging you into your gmail account. This is all part of the sandboxing side of things on iOS where application data is segmented in such a way that only that application can access it for security reasons.

Beyond that point though, we really don't gain anything by using iCloud Keychain. We couldn't use it for storing your data because the item types in the iCloud Keychain are extremely limited by comparison to our own data. At best we'd be able to sync some bits of items into iCloud Keychain but not all of your data would fit. Kind of a square peg, round hole situation.

We want to keep making our products better, and tying ourselves to something that is more limited isn't going to help us make 1Password better, it's only going to hold us back. iCloud Keychain and 1Password started off as very similar products if you go back to 1Password 1 and 2. But as version 3 came along, we started branching out and to do that we had to create our own data format (AgileKeychain) then we created a follow up to that (OPVault) and our latest system is our 1Password.com accounts which do even more things than OPVault can do. Meanwhile, iCloud Keychain really hasn't changed a whole heck of a lot since what we used to use in 1Password 1 and 2 (we used to use the OS X Keychain as our data store).

So, while your particular use case would be really neat to support. I'm afraid that sandboxing and limitations would hold us back from accomplishing that goal. And using iCloud Keychain as a sync method or as a data store for your data would simply hold us back.

Like Ben, I have a few items stored in the keychain (not iCloud keychain but just the iOS keychain) and I do this for things that are necessary and frequently accessed enough that it makes sense but are lower security than I worry about. iCloud Keychain is quite secure but the thing for me is, like you, separating my data and having it in to places. I try to limit that as much as possible so I'm not forced to update things in multiple places.

I hope that's insightful and gives you some details on why this isn't possible, at least, to the best of my knowledge anyway. But if you have any other questions let me know!