Apple Keychain as possible password manager

[bsclifton]

Carried over from brave/browser-laptop#3226

The idea would be (on macOS) to integrate with Apple's Keychain and be able to use credentials stored there (similar to behavior from Safari)

[jessecurry]

This is the big barrier to switching for me at the moment. I use auto-generated passwords on most sites, having to switch into Keychain Access every time I login to a site is painful, and switching to a less integrated password manager would also be pretty painful.

[BCtopics]

+1 This is the main reason I can't fully switch over to brave.

[Alex-GKy]

+1 agree, really one of the last things left to make this the best browser experience on MacOS

[Hermitter]

+1 Would really love this feature. Are there any plans for this yet?

[CodeWarriorr]

+1

[beegus]

+1

[samoclay]

will this be included in any near future sprints?

[bsclifton]

cc: @tomlowenthal @rebron for prioritization

[kwatsen]

One clarification, keychain integration on iOS appears to be partially working already, with Brave v1.9.1 (19.04.02.12).

On iOS, when logging into a site, I am able to auto-fill my credentials stored in Keychain.
Unfortunately, Brave prompts "Save login for for ?", to which one can hit "Don't Save", which is annoying and error-prone. Good news is that the "Save Login" prompt can be disabled in Brave Settings.

Being able to read (not write) passwords from Keychain is a reasonable user experience for now (being able to write to Keychain could come later). My wish is for Brave on MacOS (not iOS) to do the same. This issue blocks me from using Brave as my primary browser on MacOS.

[samoclay]

For Mac Desktop not iOS

…

On 8 May 2019, at 18:59, Kent Watsen ***@***.***> wrote: One clarification, keychain integration on iOS appears to be partially working already, with Brave v1.9.1 (19.04.02.12). On iOS, when logging into a site, I am able to auto-fill my credentials stored in Keychain. Unfortunately, Brave prompts "Save login for for ?", to which one can hit "Don't Save", which is annoying and error-prone. Good news is that the "Save Login" prompt can be disabled in Brave Settings. Being able to read (not write) passwords from Keychain is a reasonable user experience for now (being able to write to Keychain could come later). My wish is for Brave on MacOS (not iOS) to do the same. This issue blocks me from using Brave as my primary browser on MacOS. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[sjurgis]

This is my main blocker from switching from Chrome (and potentially Safari).

One thing to mention I kinda like about Chromes approach tho - deleting Profile (say terminating work with particular client) - permanently deletes their passwords too! So then I don't have to manually care about them.

[SchroedersKater]

Same here. I better not trust any new browser. The can tell a lot.

[samoclay]

Hey, what priority level is this? I love using Brave however my passwords are being duplicated in Brave password manager and having to copy over from Apple Keychain is a major chore.

[Hultner]

Hey, what priority level is this? I love using Brave however my passwords are being duplicated in Brave password manager and having to copy over from Apple Keychain is a major chore.

^This is my main reason for not switching to brave. 👍
Not having a keychain integration puts a major moat between me as a potential user and the brave browser.

[samoclay]

if this is super complicated, maybe an easier alternative could be adjusting the brave password manager (having it sync'ing on a brave private blockchain, Using a master key (mnemonic phrase), with an option to import/export passwords between brave-chain / apple key-chain.

[StefanLobbenmeier]

I think this issue can be closed now, Apple released a chrome extension for that that Brave users should also be able to install:

https://www.macrumors.com/2021/02/01/apple-chrome-extension-icloud-passwords-windows/
https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en-GB

As was pointed out by commenters below, it does not work on macOS and also does not fix the issue

[danjohnson95]

@StefanLobbenmeier that extension is for Windows only

[kwatsen]

And, besides, the goal is not to reach out to the cloud, but rather to the local Keychain on the MacOS system Brave is running on...

[StefanLobbenmeier]

that extension is for Windows only

I see, I misunderstood that sentence from the MacRumors article:

‌iCloud‌ Passwords is available now in the Chrome Web Store for both Windows and Mac.

While it is technically true, it does not work in my Brave on macOS:

So my bad, thanks for correcting me @danjohnson95

[openxthinking]

I use brave on iOS and it's suggesting passwords from Apple keychain. I'd like to see this behavior on macOS as well. At the moment I've to enter passwords manually on desktop, it's very inconvenient.
I've to enter them manually because I don't have much trust in Browsers keeping my passwords save. Just like I don't trust metamask as my main wallet.

[cyberfunk]

I agree 100% I love the way Apples password manager integrates so nicely on iOS with Brave (and every other App) and it just so happens that Brave desktop and mobile passwords do not sync on iOS so Apple really takes care of things on iOS with Brave! Looking forward to having one password manager across all devices. Apple is my ecosystem for the foreseeable future so I hope desktop integration comes sooner than later.

UPDATE: Pulled the plug on both Apple Keychain and Brave Password manager and consolidated everything to Bitwarden. The integration on iOS is close/similar to Apple Keychain and the desktop experience with the Bitwarden extension for Brave is excellent!

[imdatceleste]

My EUR 0.02: I like Brave, it is a great browser and yes, like all the others before me, I would like to use Brave as my default browser on macOS.
But I can't do this for the same reason as all the others: missing Keychain-Intefgration.

The problem is that I have probably hundreds of passwords in my keychain and I do NOT want to move them to Brave; I want to leave them there, synced via iCloud to my iPhone, iPad, and all my other macOS-machines (I have three).

Also, from time to time, I want to be able to use Safari for whatever reason. What I want is easy: I want my passwords available across all browsers, inline WebkitViews within apps (e.g. for oAuth2-Authentications) WITHOUT having to move them around myself OR without having to by an additional password manager (after all, Keychain is meant to be that password manager).

Until Brave has this feature, I can only use Brave for exception when Safari absolutely doesn't work on a website. Pity...

[cyberfunk]

Hello I recommend Bitwarden as your new FREE open source password manager. I turned off iCloud Keychain and only use Bitwarden in Desktop macOS and iOS and it works as well as Keychain. I had to get rid of Safari as it’s broken with a few important websites I use. Brave works with everything plus MetaMask as well which Safari does not support.

[cyberfunk]

@imdatsolak Why the downvote? Bit-warden basically solves your issues at least in the short term.🤔 Btw I do not work for and am not affiliated with Bit-Warden in any way.

[imdatceleste]

@cyberfunk because I already explained above why I don't want to use another password manager. This would, again, require me to use TWO different password managers - Keychain and BitWarden. The fact is that I use Keychain for many, many solutions/apps and all of those would need to support BitWarden instead of the standard system-API.

The downvote was because you already had mentioned BitWarden before, I then explained why using a second password manager is not an option for me and you came back again with BitWarden :-)

[lil5]

👎 This promotes a non-free Apple service. There is an extension for this.

https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj

[SebastienElet]

@lil5 this extension is not working on MacOS ATM.

[Haravikk]

Won't work that way

This issue's title says Apple Keychain as possible password manager? I suppose the question is about Brave sharing passwords with Safari in the Keychain. But I think it won't work that way. If I'm right Apple doesn't want anything to access Safari's passwords in the Keychain, they do encourage alternative password managers.

Safari stores passwords in a keychain, and any iOS/macOS app can request access to passwords stored in a keychain. However, if they're not the app that created the entry, the user will be asked to confirm access (Deny, Allow or Always Allow), with the latter option giving the app permanent access to that keychain entry.

I believe there's also an entitlement that allows an app to request stronger access to keychain entries (so you don't need to be prompted for every single one), but personally I'd be fine with the individual prompts.

Add me to the long list of people who would like to see native password integration; it's currently a mark against Brave on macOS, which is otherwise excellent.

[kupietools]

3 years later, is there any news on whether this will be included or not? Badly missing it.

[imdatceleste]

👎 This promotes a non-free Apple service. There is an extension for this.

https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj

Please re-read the whole discussion: we are talking about a solution for macOS, not Windows (your link) and also not an Apple service (as you say).

• The extension you mention has already been mentioned way above in this thread;
• The extension you mention is Windows only;
• and no, it doesn't solve the problem described here.

We are not asking to support "a non-free Apple service".

We are asking for an integration with a macOS-Feature (the Keychain-Library/-Framework/-Database) which was already available with macOS 9(!) around the turn of the millenium.

If you are not a user of a specific platform (here: macOS), please refrain from commenting on topics related to the respective platform.

[FullStackAlex]

Check out this thread and answer to (better) understand why this feature is not possible / not available:
https://community.brave.com/t/mac-os-keychain-integration/54353/6

[FullStackAlex]

Still wonder though, why they don't check this GitHub Issue at all..

[Haravikk]

Check out this thread and answer to (better) understand why this feature is not possible / not available:
https://community.brave.com/t/mac-os-keychain-integration/54353/6

While this is interesting, I'm not sure that the conclusion on the Chrome issue is correct; while app store apps are required to declare their entitlements, an app does not need to be distributed through the app store to declare entitlements. Any signed app can now be sandboxes, and should be able to request the keychain-access-group entitlement.

Also, even without this entitlement it's still possible to use the Keychain to store passwords; you only need the keychain-access-group if you want to access/manipulate passwords stored in the iCloud (local items) keychain. If a user isn't using iCloud keychain then these passwords are still shared with other keychain enabled browsers. iCloud keychain isn't enabled by default, even with iCloud enabled, and I don't use it personally as I find it a pain in the arse (just generates loads of conflicting passwords and headaches in my experience).

[FrancoCorleone]

We're half way into 2022. Any updates on this? I'm struggling with full migration to Brave just because of that feature

[okonon]

I gave up waiting for this feature and started to use Bitwarden to get a constant password manager experience across all platforms and Brave.

[imdatceleste]

I gave up waiting for this feature and started to use Bitwarden to get a constant password manager experience across all platforms and Brave.

I gave up on Brave completely for anything other than JitsiMeet-Calls - because of this issue. As someone else said, it is freakin' 2022 - I was even willing to pay something for this feature...

[GitStudying]

I gave up waiting for this feature and started to use Bitwarden to get a constant password manager experience across all platforms and Brave.

I gave up on Brave completely for anything other than JitsiMeet-Calls - because of this issue. As someone else said, it is freakin' 2022 - I was even willing to pay something for this feature...

Just brave or chromium in all it forms then? Because chromium is not really the issue. The issue is Apple and there way to boxed in attitude to things, most notably a password manager. If you read through this issue page there are a lot of struggles and workarounds needed to make it work properly and even then it is not guaranteed as Apple could always just revoke the application (from the App store) and break all the work put in. My girlfriend uses a mac, now quite old but she is a Apple person and will probably continue to be one. That is fine but she also get triggered because of this, she uses Brave on both her iPhone as well as macOs, but she uses keychain and is quite hessitant to give up on it. I get it because the full autofill experience on iPhone works best using keychain, and for example Bitwarden works if set up properly but not as nice in some ways and not as fast often. I get the whole chromium following its kind of hate but unless Apple changes there is not much we can do. At least don't blame or rant to chromium browsers. If they would make it work then it would be awesome, if not I fully understand.

[Haravikk]

The issue is Apple and there way to boxed in attitude to things, most notably a password manager.

As I pointed out above, this isn't the case; Brave doesn't need to be an app store app to include the entitlement required for keychain access (including iCloud keychain access), you can include these entitlements in any ordinary app bundle.

So it's entirely possible for Brave to use the keychain for passwords they just… won't.

[StefanLobbenmeier]

It looks like a solution might be coming from Apple: https://www.macrumors.com/2023/07/12/macos-sonoma-apple-passwords-third-party-browsers/

[GitStudying]

That is a good outlook for sure, but still that is only for new macs, I feel there are many users that are not able to update to the latest macOS versions but still use their mac often. They are kind of screwed, unless brave still implements this. Also depending on Apple it's extension integration the usage might be quite bad but I haven't tested it for myself so I don't know.

[kindtek]

It looks like a solution might be coming from Apple: https://www.macrumors.com/2023/07/12/macos-sonoma-apple-passwords-third-party-browsers/

i am assuming this is the method brave would use to be enabled as an option for ios keychain autofill such as in below screenshot, correct?

is there any way i could contribute to get brave added as an autofill option? without it, my password situation is a copypasta nightmare

[StefanLobbenmeier]

@kindtek no not at all, it’s completely different

• it’s on macOS
• and it’s in the other direction, using safari/keychain passwords in brave

(I’m pretty sure that feature already exists on iOS, but on macOS not yet)

The screenshot you showed is something brave would have to implement, allowing all apps to access the brave password manager

[jtheletter]

I also wish Brave Browser for macOS could autofill passwords from my iCloud keychain.