I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other device or actual paper? Or am I worrying too much?


I would use a good password manager that encrypts the password database with a strong key, and use cloud to backup the resulting file. This way even if the cloud storage is hacked, your password database is encrypted.

If the cloud storage is offline, nothing is lost, because you use it to backup the database. And you don't need to trust your brain to create and remember complex passwords. Because no matter how complex your password is, if you reuse it and a malicious agent (or malicious service) gets your password, you are toast.

A good password manager solves both problems: creates very strong passwords, unique for each service, encrypts the database and allows for safe cloud backups.


A better password policy is to come up with a single cypher that allows you to come up with a long password for each and every different system you use, that will be unique to it. For example, your personal cypher may be (Your favorite color in all caps) + ("&" symbol just because) + (Your dog's name in all lower case) + (the 1st, 4th, 2nd, and 7th character of the domain or product) + (the word "Book").

So this schema applied to stackexchange.com might be something like BLUE&rexsctxBook

This can be further improved with a few character replacement rules like e=3, t=+, and o=0 so you then get: BLU3&r3xsc+xB00k

Now you have a long and randomized password. It has all the strength of a truly random password and you only ever need to memorize your cypher once to be able to make passwords that are different enough to resist cross platform exposure. You may need to write your cypher down at 1st until you learn it, but at that point you can burn it and never need to back anything up because it's all in your head.

PS: don't use this exact cypher, it is for demonstration purposes only and became insecure the second I put it on the internet.


Primarily, easy of use. Even once you know a cypher, you need to think a little bit when you put it in. This will typically slow down logins on systems you don't use often as you have to think about it. Systems you use often, you will memorize just fine over time.

Technically, the long random passwords generated by keychains have more entropy than a personal cypher; however, when you understand the process of password cracking, you realize that even technically weak passwords in the 15+ character range are virtually unbreakable by any means other than reuse, and reuse becomes a much smaller problem if you can't crack it to begin with. Since your master password should be this strong anyway, there is no practical difference between a 16 character cypher and a 64 character random string protected by a 16 character password. As long as your cypher is too long and complex to crack within a human time scale then it is no more likely to be compromised in a service-side data breach.


The biggest day-to-day thing that makes it better is that reuse is only a problem if enough of your accounts are compromised for a hacker to determine a reuse pattern. And, chances are that any hacker with multiple lists of hacked accounts on you probably isn't wasting his time on such high-hanging fruit unless he is specifically targeting you.

A second advantage is that a compromised computer/cell-phone does not leak all of your accounts the 1st time you log into something. If you get some spyware, visit stack exchange, then clean up the spyware, you have only granted the hacker access to stack exchange. If you do this with a keychain, he has everything: your bank, your email, etc.

That said, there is another more rarely discussed but much more important reason not to use a keychain over a cypher:

In cybersecurity, one way to measure a system's level of vulnerability can be measured by how much access a hacker already needs to compromise a system. When you pentest, you do so from one of 3 starting places:

  • Blackbox: You are given no information about the system.
  • Greybox: You are given standard user account access.
  • Whitebox: You are given direct access to all the tools a system admin would have.

When you save a password online, it is typically hashed. This means even a system admin cannot reverse it to find your original password. When such an account is compromised, the hacker steals the hashes. If the hashes each have a unique salt (as most modern hashes do), then the likelihood of the hacker actually being able extract any half decent passwords by brute force is slim to none. These passwords are considered whitebox secure meaning even if your hacker is a system admin, he generally can't get your password.

When you save a password into a keychain, it is encrypted. This means that it is encoded in a way that is unreadable until you decrypt it using a secret key. This secrete key (master password) is generally kept safe from other users, but is virtually impossible to keep safe from a hacker with system admin privileges. If your keychain provider's system were ever compromised it would be trivial to distribute an update that could decrypt and steal all of your passwords the first time you enter you master password.

Such a breach is considered by most security experts to be relatively unlikely, but all it really takes is the right system admin accidentally opening the wrong email, or installing the wrong app on his phone. If it were to happen, it could compromise hundreds of millions of critical accounts overnight including bank accounts, medical records, classified documents, you name it.

In short, while keychains are really hard to break, when someone does break them, the repercussions are the worst kind of data breach you can possibly imagine.

Despite their flaws, I do still think that keychains are a significant improvement over most people's typical approach to cybersecurity of using many minimally hard to crack passwords or the same strong password for everything, but when you compare their strengths and weaknesses, a good cypher is simply better.

  • 1
    @Nosajimiki It can be hacked, and all they get is an RSA-encrypted blob. The password for that blob is a master password that I have to remember. I remember one long password, the password manager saves dozens and dozens of non-sensical long unique passwords. – ThoriumBR Oct 9 at 1:54
  • 1
    There is a gap on your argument in that you can't consider that the will be hashed. First, there are sadly insecure sites out there that are not following even basic best practices like this. But the main reason is that you could be registering into the service provided by the evil guy to gather passwords. Ideally you should assume that they have the plaintext password you entered on some site. – Ángel Oct 9 at 23:32
  • 1
    There is also a strong assumption that your "cypher" algorithm won't be reversed, which may or may not hold. and it is hard to measure how secure it is, which is worrying given that such algorithm being broken would also be catastrophic, similar to a keychain compromise. – Ángel Oct 9 at 23:35
  • 1
    However, the main problem is likely to be an usability one. Did you use this domain name or the product name? Or the old name this store used to have? Then, as password rules are not standardized in any way, some sites will choke at BLUE&rexsctxBook containing a &, whereas a second one would require a number, and yet other consider it too long. Thus you need the same approach when logging in (they sometimes don't even publish these rules even on the signup page, so good luck figuring out how you needed to tweak it for this certain site). – Ángel Oct 9 at 23:42
  • 1
    As a final solution for your "what if the full system is compromised?", while the benefits of a keychain, I would recommend you to use a password manager such as pass, which encrypts each entry separately, combined with a hardware device requiring touch for storing the (dedicated) PGP key used to decrypt them. This way, even in case of full system compromise, the attacker could only have accessed the entries that were decrypted while the system was compromised. As the token requires physical interaction, a remote attacker could not undetectable stolen the rest – Ángel Oct 9 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.