1. 程式人生 > >Ask HN: Why don't Google or Apple make complete password Managers?

Ask HN: Why don't Google or Apple make complete password Managers?

OMG this whole situation infuriates me.

I've complained about this to Google's security folks, and basically the answer I got there was that they don't believe in password managers as a solution and would rather have FIDO/U2F become a thing.

Another part, I think, is that building a password manager is hard. I tried to build my own and quickly found that the problem of finding out which fields are username/password fields was not always easy. Some websites don't even mark password fields with type="password", so you end up with JavaScript ML systems and massive site-specific lists for guessing which fields are username/password fields, and it's a pretty big task to make it really work.

Also, if you've ever recommended a password manager to someone not very technical, pretty soon they forget their master password, and now can't access their passwords, and its' your fault.

Having said all that, Chrome's password manager has been getting better, and they do have an app auto-logic on Android, so maybe those will combine. But I don't think it's a good lock-in strategy for Google, because they don't have a holistic ecosystem - most people are not using Chromebooks - so there isn't really any lock in play for them. Same thing goes for Microsoft, and to some extent Apple, since Safari isn't overwhelmingly popular on OSX.

IMO what is really needed is a standard for this, rather than lock in, so that these companies can co-operate on this and stop trying to make this a marketing bullet point.