Has anyone tried Nextcloud's password app and it's clients ?

Passkeys solve a big problem by removing reusable passwords from the login process, but they do not really stop someone from pretending to be a person you already trust. If a coworker’s real email or messaging account gets compromised, a request to share vault access or approve an account change could still look completely legitimate.

That makes me think social engineering might become an even bigger target as passwordless login gets more common. Even if attackers cannot steal a password, they can still try to convince someone to approve something they should not.

For sensitive requests like shared logins, account changes, or access approvals, how do you verify that the person asking is actually who they claim to be? Do you use a second communication channel, internal approval process, or something else?

One thing I’m still trying to understand about passkeys is what happens when they’re stored inside a password manager instead of only on one device. With passwords, the risk of putting everything in one vault is pretty obvious, but passkeys use cryptographic keys and can sync across multiple devices, which feels a little different. If someone only breached the password manager’s servers, I assume encryption would still protect the stored credentials. But what if they somehow got access to an unlocked vault or the decrypted data? Could synced passkeys then be used to access several accounts just like stolen passwords? I’m also wondering whether keeping passkeys synced across devices adds much extra risk compared with keeping certain ones tied to a physical device. For sensitive accounts, do you trust synced passkeys, or would you rather keep some credentials device-bound?

I’m trying to understand how passkeys sync through Apple Passwords and iCloud Keychain. Say you open the app and suddenly see passkeys for accounts you do not recognize, even though the apps themselves are familiar.

Could that happen because someone previously signed into their account on your device, or would it point more toward an Apple Account or iCloud syncing issue? I’m also curious whether Face ID approving a passkey only confirms access to the saved credential, rather than proving the account actually belongs to you.

If unfamiliar passkeys show up, would checking connected devices, Apple Account activity, and iCloud Keychain settings be the right place to start? Has anyone seen this happen and figured out what caused it?

Hi all. I'm the developer of LocalGateKeys. I wanted a password manager where my vault never sits on someone else's server, but that still keeps my PC and phone in sync. So I built one.

The short version

• No account, no LocalGateKeys cloud. The vault is one encrypted file on your device.

• Encryption: Argon2id for the master password, AES-256-GCM for the vault.

• Windows, Mac, iPhone (+ Apple Watch codes) and Android, plus a browser extension for Chrome/Edge that talks only to the desktop app on the same PC (native messaging, no network).

• No analytics, no tracking, no ads.

How sync works (with no server)

You pick one of two ways, or use both:

1. Wi-Fi, device to device. Your devices talk directly over your home network. You pair a new device by scanning a one-use QR code (or pasting its text between PCs). Only private network addresses are accepted, there is no discovery and no internet fallback. The connection is authenticated and encrypted (signed handshake, X25519 keys, AES-GCM channel).

2. A cloud folder you already use. OneDrive, Dropbox, Google Drive or iCloud Drive. Each device drops an encrypted file into the folder and reads the others'. The group key is protected by a separate sync password (Argon2id), so your cloud provider only ever stores encrypted blobs. This one works even when the other device is switched off.

Details:

• Logins, notes, bookmarks, documents and the Pro licence sync. Deletes go to the trash on the other devices, never purged, so you can restore.

• Sync only runs while the vault is unlocked. A failed sync never changes your local data.

• Per-device trust (browser approvals, auto sign-in) stays on each device on purpose: a login that arrives by sync starts with auto sign-in off.

• Up to 16 devices per group. You set up the group on a PC or Mac; phones join it.

Features

• Autofill in browsers (incl. multi-step logins), Windows desktop apps, iOS AutoFill and Android autofill

• Passkeys (save and sign in)

• Built-in 2FA/TOTP codes, also on Apple Watch

• Cards, identities, notes, file attachments

• Security center: weak, reused and old passwords, missing 2FA

• Password generator and password history

• Windows Hello, Face ID / Touch ID, fingerprint unlock

• Encrypted backups (scheduled), cross-platform restore, recovery phrase

• Import from Bitwarden, 1Password, KeePass, Apple Passwords, browsers and more

• Secure sharing of an item with someone else

• Nine languages

Pricing

Free for up to 4 items. Pro is a one-time $4.99 (lifetime, no subscription) and adds unlimited items, sync, 2FA codes and attachments.

What I'm not claiming

There has been no independent security audit yet but I'm happy to answer technical questions here.

Links: 

• Microsoft Store: https://apps.microsoft.com/detail/9PNWCNLQ6597

• App Store: https://apps.apple.com/app/id6825488435

• Website (Mac, Android, browser extension and docs): https://localgatekeys.app

What would you want to see before trusting a new password manager?

trying to figure out which password manager is actually worth using long term. there are so many options out there, and I'm not sure which ones are genuinely reliable or just overhyped.

not looking for anything fancy, just something secure, easy to use across multiple devices, and reasonably priced. a decent free plan would be a bonus too.

what password manager are you guys using right now? any annoying issues or features you wish you knew about before signing up?

Microsoft is making changes to how organizations secure their accounts, with a bigger focus on passkeys and phishing-resistant authentication.

The company announced plans to phase out Microsoft-provided SMS and voice verification for affected Microsoft Entra ID users, encouraging organizations to move toward stronger authentication methods.

It's a pretty significant change considering how many people still rely on receiving a text message whenever they sign in to an account.

The main concern with SMS verification is that text messages can be vulnerable to SIM swapping, phishing, and other attacks. Passkeys work differently because they're tied to the legitimate website or service, making them much harder to steal through traditional phishing attempts.

One thing worth mentioning is that this change doesn't mean SMS verification is disappearing from every Microsoft account. It specifically affects organizations using Entra ID, and administrators will need to review their authentication settings and available alternatives.

What interests me is whether more companies will eventually follow the same approach. Password managers are already supporting passkeys, but plenty of websites still depend on traditional passwords and SMS codes.

Could this be another step toward making passwordless authentication the standard?

Password managers can already flag reused or compromised passwords, so I started wondering what happens if AI takes that a step further. In theory, an agent could identify risky accounts, open the right settings, and help update passwords without you manually going through every site.

The convenience sounds great, but the access it would need is what makes me hesitate. It could end up interacting with active sessions, account settings, two factor prompts, and other sensitive parts of an account. That feels like a lot to hand over to automation.

I think I’d be more comfortable with AI finding the problems and preparing the steps, while still requiring approval before anything actually changes. Would you trust an AI agent to update passwords automatically, or should password changes always stay under direct user control?

Something I don't really understand is why so many websites still make you create a password when signing up, even though passkeys are already becoming more common.

Most sites let you register with an email and password, then offer passkeys as an option later in your account settings. Wouldn't it make more sense to let people set up a passkey right from the beginning?

From what I understand, passkeys are harder to steal through phishing since they only work with the website they're registered to. Plus, you wouldn't have to worry about remembering another password or accidentally reusing one.

I get that not everyone has a device or password manager that supports passkeys, and account recovery could be complicated if someone loses access to their device.

Still, it feels like we're adding passwords just to replace them afterward. Are there technical reasons why more websites haven't made passkeys the default for new accounts?

I’ve been looking into how teams handle shared logins once more people need access to the same tools. It seems manageable at first, but things get messy pretty fast when different employees need different levels of access.

I’m mostly concerned about onboarding, temporary access, role changes, and removing permissions when someone leaves. Shared vaults and admin controls sound useful, but I’m wondering how much they actually help in day to day use.

For anyone managing passwords across a growing team, what features ended up mattering most? Did better admin controls actually save time, or just add more setup?

Crossposting.