For security reasons, we always recommend that you use a password manager like 1Password or LastPass to generate, store, and enter strong passwords in your Web browser. We hope you’ve been doing that because iOS 12 has a fabulous new feature that lets you enter passwords from third-party password managers in addition to iCloud Keychain. It makes logging in to Web sites—and iOS apps!—vastly easier than before.
Set Up AutoFill
To begin, you need to enable the feature. Go to Settings > Passwords & Accounts > AutoFill Passwords. Tap the AutoFill Passwords switch to turn the feature on, and select your password manager in the list below.
Two notes. First, the iOS app for your password manager must be installed for it to appear in the list. Second, although you can also allow iCloud Keychain to fill passwords, it’s not worth the extra confusion unless you have a lot of passwords stored only in iCloud Keychain.
Log In to a Web Site in Safari
Now it’s time to try the feature. Navigate to a Web site where you need to log in, and for which your password manager has stored your credentials. Then follow these steps:
- Tap in the username or password field.
- iOS 12 consults your password manager, and if it finds a username/password pair that matches the domain of the site, it displays the username for the site in a blue button or in the QuickType bar above the keyboard. Tap it, and unlock the password manager using your password, Touch ID, or Face ID. iOS fills in your credentials.
- Tap to continue the login process.
If you have multiple accounts for the same site, you may see several of them in the QuickType bar, but if the one you want doesn’t appear, or if none appear, tap the key icon to see all available passwords. If none are right even still, tap the name of your password manager at the bottom of the list to open and search it manually.
Log In to an App
The process of logging in to an app is often similar to logging in to a Web site, as with the Dropbox and Netflix apps, but iOS 12 doesn’t know how to match every app with an associated account in your password manager. For an app that iOS 12 can’t identify, like the Pixabay app, follow these steps instead:
- Tap in the username or password field.
- In the QuickType bar, tap the key icon to open your password manager.
- If necessary, unlock it with your password, Touch ID, or Face ID.
- Search in the password manager for the associated account.
- Tap the account to autofill it in the app’s login fields.
Password Manager Limitations
As welcome as iOS 12’s new support for password managers is, it’s lacking in two important ways:
- The autofill integration is limited to usernames and passwords, so if a site requires an additional field for login, you’ll have to enter that information manually. Similarly, it won’t enter credit card numbers or other information the password manager can autofill when used on a Mac.
- The password manager can’t automatically create new accounts or generate new passwords, as all password managers can do on the Mac. You can do both manually, but the process is so clumsy that it may be easier to wait and do it on a Mac later, or use an easily typed password temporarily until you can change it to something stronger on your Mac later.
Despite these annoyances, iOS 12’s support for third-party password managers is a huge step forward for anyone who wants quick access to the same login credentials on an iPhone or iPad.
Data breaches have become commonplace, with online thieves constantly breaking into corporate and government servers and making off with millions—or even hundreds of millions!—of email addresses, often along with other personal information like names, physical address, and passwords.
It would be nice to think that all companies properly encrypt their password databases, but the sad reality is that many have poor data security practices. As a result, passwords gathered in a breach are often easily cracked, enabling the bad guys to log in to your accounts. That may not seem like a big deal—who cares if someone reads the local newspaper under your name? But since many people reuse passwords across multiple sites, once one password associated with an email address is known, attackers use automated software to test that combination against many other sites.
This is why we keep beating the drum for password managers like 1Password and LastPass. They make it easy to create and enter a different random password for every Web site, which protects you in two ways.
- Because password managers can create passwords of any length, you don’t have to rely on short passwords that you can remember and type easily. The longer the password, the harder it is to crack. A password of 16–20 characters is generally considered safe; never use anything shorter than 13 characters.
- Even if one of your passwords was compromised, having a different password for every site ensures that the attackers can’t break into any of your other accounts.
But password security hasn’t always been a big deal on the Internet, and many people reused passwords regularly in the past. Wouldn’t it be nice to know if any of your information was included in a data breach, so you’d know which passwords to change?
A free service called Have I Been Pwned does just this (“pwned” is hacker-speak for “owned” or “dominated by”—it rhymes with “owned”). Run by Troy Hunt, Have I Been Pwned gathers the email addresses associated with data breaches and lets you search to see if your address was stolen in any of the archived data breaches. Even better, you can subscribe to have the service notify you if your address shows up in any future breaches.
Needless to say, you’ll want to change your password on any site that has suffered a data breach, and if you reused that password on any other sites, give them new, unique passwords as well. That may seem like a daunting task, and we won’t pretend that it isn’t a fair amount of work, but both 1Password and LastPass offer features to help.
In 1Password, look in the sidebar for Watchtower, which provides several lists, including accounts where the password may have been compromised in a known breach, passwords that are known to have been compromised, passwords that you reused across sites, and weak passwords.
LastPass provide essentially the same information through its Security Challenge and rates your overall security in comparison with other LastPass users. It suggests a series of steps for improving your passwords; the only problem is that you need to restart the Security Challenge if you don’t have time to fix all the passwords at once.
Regardless of which password manager you use, take some time to check for and update compromised, vulnerable, and weak passwords. Start with more important sites, and, as time permits, move on to accounts that don’t contain confidential information.
Passwords are the bane of our modern existence. Nearly anything you want to do, it seems, calls for a password. As the Internet’s reach extends beyond computers and into phones, TVs, appliances, and even toys, we have to enter passwords with increasing frequency and in ever more annoying ways. Here are our best practices for Secure Passwords.
To make dealing with passwords easier and more secure, everyone should use a password manager like 1Password or LastPass. Such apps generate random long passwords like kD*SSDcCl7^6FN*F, store those passwords securely, and automatically enter them for you when you need to log in to a Web site. They are essential in today’s world.
You’ll still need a few passwords you can remember and type manually—for instance, the master password for your password manager and your Apple ID password. Make sure those passwords are at least 12 characters, and we recommend going to at least 16 characters.
If you’re unsure of the best way to create a strong password, try taking the first letter of each word in a sentence you can remember, and also change a few words to digits. Then “Now is the time for all good men to come to the aid of the party!” becomes a password along the lines of
Nitt4agm2c2ta0tp! . So that no eavesdroppers learn your password, avoid saying your sentence out loud whenever you enter it! Or, combine four or five unrelated dictionary words, like
correct-horse-battery-staple , that add up to at least 28 characters. (Don’t use the examples in this paragraph!)
When possible, take advantage of two-factor authentication on sites like Apple, Google, Dropbox, Facebook, Twitter, and more. Accounts protected by two-factor authentication essentially require that you enter a second, time-expiring password as part of the login process. You’ll get that second password via text message, authenticator app, or other notification method when you log in.
But what we really want to talk about today is what you should not do with passwords. Follow these tips to avoid making mistakes that can undermine even the security provided by a password manager.
- Don’t use the same password twice. This is key, because if the bad guys get your password—no matter how strong—for one site, they’ll try it on other sites.
- Don’t share passwords with anyone you don’t trust completely. That’s especially true of passwords to accounts that contain sensitive information or that can be used to impersonate you, like email and social media. However, sometimes you have to share a password, such as to a club blog with multiple authors. In that case…
- Don’t send passwords to shared sites via email or text message. If someone hacks into your recipient’s email or steals their phone, the password could be compromised. Instead, use a site like One-Time Secret to share a link that shows the password only once, after which the recipient should put the password into their password manager.
- Don’t write your passwords on sticky notes. Yeah, it’s a cliché, but people still do it. Similarly, don’t put all your passwords in a text file on your computer. That’s what password managers are for—if someone steals your computer, they can’t break into your password manager, whereas they could open that text file easily.
- Don’t change passwords regularly if you don’t have to. As long as every site has a strong, unique password, changing a password is a waste of time, especially if doing so makes you write down the password or communicate it insecurely. If you do have to update a password regularly, a password manager makes the task much easier.
We realize that it’s tempting to take the easy road and share a password with a friend via email or write a particularly gnarly one on a sticky note. But today’s easy road leads directly to identity theft and is paved with insecure password habits. You might think no one would pay attention to little old you, but times have changed, and organized crime is interested in any Internet account that can be cracked.