ICloud

This is meant for discussion. Due to some breaches I had made the decision to update all of my passwords for various accounts. As I am a big fan of Apples integration I decided I would use the iCloud password manager on both my Apple devices and my PC, this way I can have more secure passwords which sync across all my devices.

The thing I noticed however was that there was no option to amend your desired complexity. What I discovered was that all passwords were 20 characters in length, contained 1 uppercase, 1 number and 2 hyphens in the 7th and 14th place.

Convention would suggest that we should be using special characters for passwords but when Apple only allows hyphens to be used in the same 2 locations across all passwords, it seems that using special characters at all becomes completely redundant.

I was also surprised about only 1 number and 1 uppercase letter as it would seem much more secure to randomise this. So every password could have somewhere between say 1 and 10 uppercase letters and numbers.

As a result of this brute force password crackers already have the following information: There must be 1 uppercase letter in any one of 18 locations There must be 1 letter in any one of 18 locations. There are 2 hyphens in place 7 and place 14. When in reality a password cracker should have absolutely 0 information to go on.

In comparison to Keepass where you can choose how many letters, numbers and special characters and it shows you how strong the password is, Apples security just seems to be lacking.

Of course this is still more secure than a user generated word or phrase, however I feel that Apple should still do more to improve their password generation. What does everyone else think and out of curiosity does anyone know how long it could take powerful tools to crack? Assuming no other security such as lockouts and MFA?