Yea, I saw that during the WWDC keynote and physically cringed. As the article says, what could go wrong?

There's this standard that is being worked on by the people working on the Passwords app at Apple (They are active on Mastodon, and often talking about that) which will probably be helpful for this feature too: https://www.w3.org/TR/change-password-url/

I mean isn't it either to complex to implement or not a good implementation kind off thing?

A good chunk of people do use devices other than apple eco system one's and if they try to login and then suddenly, you can't!

Yes, also immediately thought of all the endless ways this could go wrong and end with someone losing access to their account, which depending on their account could be trivial or life altering, especially if their loss ends up being someone else's gain. Apple takes baby steps so I'm sure this will be limited in nature and most likely will get delayed until fully tested, but I'd definitely avoid testing during betas (with any real accounts that is).

Can it be turned off ?

People already have a hard time remembering passwords without them being automatically changed.

Call me when it can _delete the account_ from all those websites, which is likely the primary reason the user has not updated the password yet.

This could have nuclear level consequences. Imagine somehow your keychain is compromised. Using a change password URL means an attacker could literally lock you out of every account at the same time

I already let 1Password generate all my passwords, so as long as they're just invoking tools with AI rather than having it attempt manually, it doesn't seem like such a big deal?

I’ve had the iOS password app think that it changed my password, when it did not, and then lose my old password.

This article appears to be 100% AI. I guess there's some irony that a company ships an AI feature and someone else uses AI to come up with criticisms of that feature. But the article... doesn't actually say anything?

It's just full of weird, generic short-sentence LLMisms ("Detection is observation.", "Changing the password is authority.", "The security benefit is real.", "That is a meaningful improvement.", "This is not just text generation. It is an agent taking action with a sensitive credential.", ...).

I wonder whether the AI generated password that you allow to be created on your iPhone in the Passwords app can be recovered and added to whatever password manager you might be using on Windows or Linux desktop.

It seems like this is a great way to lock oneself out of access to an account on some of the devices that they own that do not have access to the Passwords data storage.

I can see where this can be a benefit in helping users secure their accounts with stronger passwords but I think that there is a lot of potential for this to become a real problem.

Very curious if they're implementing browser driving themselves or using an off-the-shelf library like stagehand, browser-use, etc. to drive the DOM. Hopefully they open source it if it's in Swift.

A11y-tree alone is not enough for many sites because lots of auth stuff happens in OOPIF frames that need special handling/stitching/interactive element filtering.

Do terms of service apply to a robot clicking buttons and typing stuff?