Recommend a mobile iPhone IOS password manager

[Turbinator]

It's about time I get on board with managing my passwords in a secure mobile app. What do you use? Why do you like it? What to avoid or be aware of? This will be used on iOS.

Thanks folks,
Turby

[DaveInOroValley]

I don't use a specific manager on my iPhone but I did find this:

https://www.top10cybersecurity.com/password-manager?bkw=password%20manager%20for%20iphone&bcampid=370249127&bcamp=Password%20Manager%20US%20Bing&bagid=1188572952057263&bag=comparison&btarid=kwd-74285968526334:loc-4083&bidm=be&bnet=o&bd=c&bmobval=0&bt=search&utm_source=bing&utm_medium=cpc&utm_term=password%20manager%20for%20iPhone&utm_campaign=Bing+CPC+Campaign&c=74285997910040&m=e&k=74285968526334&binterest=&bphysical=76360&bfeedid=&a=B6008&ts=&topic=&upf=&msclkid=4d9d65b2acf01489e8a90715fb008e74

[Misterclick]

1Password works well for me for both personal and business

[Robotron2k84]

I would caution against any password manager that exposes its keystore to cloud resources. I would advise that such a store remain on the device-only.

[yolocalypso]

LastPass works decent for us and our work.

[Turbinator]

I would caution against any password manager that exposes its keystore to cloud resources. I would advise that such a store remain on the device-only.

Keychain is cloud based, therefore security risk?

I checked, I had it disabled on my phone from long ago when I first became an IOS user. I think it was because I didn't trust the cloud with my info. Seems nothing has improved in this area...

Turby

[Robotron2k84]

PKCS keychains like Apple’s can have multiple access keys, so not only your password or certificate, but also Apple’s or the NSA’s. Unless you generate the keystore yourself and know that keystore isn’t being read and written to, behind your back, while it’s open, you can’t be sure what data is in there or who has access. It’s difficult to get the keystore off the phone, although on the Mac it’s pretty easy.

Do they do things behind your back? For the most part, no. But, Apple had the iCloud photo dust-up last year that they were hashing and scanning your photos on upload, so they aren’t completely trustworthy. And, there’s no way to automatically audit the contents before or after it’s uploaded to iCloud. If an Apple (or other) signed access cert is included in the upload, all the data can be read back by a third party. So, in the absence of a clear method to audit for access and authorization, it can’t be accounted for and breaks the security model, i.e. shouldn’t be trusted.

[67Cuda]

LastPass works decent for us and our work.

This is what I use. It's free just for your phone.
I use the paid version, which you can use on unlimited devices and are linked and updated.
Best thing I've done as far as computer related convenience.

[pbsmind]

KeePassium for iOS.

[shotcaller6]

I've been using B-folders for years, I use it on Android, Windows and Linux.

I believe it is available for IOS as well.

[NorCalBusa]

Does Apple's own "Authenticator" on iPhone not do the job?

[erik]

I use an older version of 1Password, that still has local vaults and local (LAN) sync.
All the commercial brands are going towards online sync, but are usually OK for encrypting/decrypting local so that the vendor never holds the unencrypted. (Some also allow for sync via DropBox, again, with the passwords encrypted.)

LastPass has been part of a race for the bottom. I used them (as admin) for corporate use the past few years and they've gotten worse to the point where I no longer recommend them for personal use, let alone corporate.

1Password has also been dropping in overall "security" with requiring being online to sync between local devices. At least not yet an admin nightmare.

I'll probably end up going KeePass for local, unless some other commercial vendor steps up. (I've been using a paid older version of 1Password, 6.)

[mikeyr]

strongbox, there is both a free and paid version. It uses a Keepass database so its also compatible with Keepass making it work on any platform out there built in the last few decades. I used to use keepass on Windows, KeepassX on Apple, iOS and OSX, I have switched to Strongbox on IOS and OSX but since it won't work on Windows, I still use Keepass on Windows at work, same database on all 3.

[WoodTurner]

I would caution against any password manager that exposes its keystore to cloud resources. I would advise that such a store remain on the device-only.

For a more advanced user, I definitely agree. For the majority of people though, a cloud saved password manager is 1000x better then nothing and will be much less likely to have problems.
It's a chore managing and backing up your own password database and I'd be afraid of a non techy not backing up to external devices enough or at all.

I recommend bitwarden for most people. The paid cloud backup is very cheap compared to others and it has the ability to host your own for the more advanced users.

[rodralig]

It's about time I get on board with managing my passwords in a secure mobile app. What do you use? Why do you like it? What to avoid or be aware of? This will be used on iOS.

Thanks folks,
Turby

I use 1Password


_