Hello, sorry for the delay.
You just need the iOS version to use this feature. The browser extensions are free.
Sharing items is not possible yet but something we definitely want to add in the future!
Happy to know you liked it ;) I don’t have plans for Android just yet. Secrets makes use of many of Apple’s frameworks so porting it is not an easy task. I’ll count your +1, though.
Not sure I understand what you're asking. I don't think FF has an API where I would be able to sync would it. But if you can export your logins to a CSV you can import them with Secrets for Mac (importing is not yet possible on Secrets for iOS).
If you do want to use Firefox on iOS (irrespective of having your logins there or not), Secrets is also able to fill in FF using iOS's Password AutoFill feature.
Finally, and as side note, on iOS 14 you should be able to set Firefox as your default browser on iOS.
iCloud Keychain is handy for simple use cases. But it quickly breaks down if you want to have a good password habits.
For example, I use my Apple ID to login to a bunch of different Apple sites. With the keychain that would create separate entries for each site although they are the same. Change your password and you'll end up with items with outdated passwords (which you'll only find out when you try filling them).
The keychain is also cumbersome to create items manually (imagine you need to save an SFTP or VNC login?). Furthermore how would you have access to these items on your iOS device?
You also can store more than just passwords with Secrets.
No untrusted component will have access to your data without user confirmation. This means you'll always have to click a button on the main app to fill a login for example.
There are two ways in which logins are filled in the browser:
- One is based on OS X Automation and AppleScript (this will work with Chrome and Safari without our Safari App Extension enabled). Succinctly, with this solution, Secrets will execute a small JS script on your frontmost browser windows to see if there are any logins to be filled. If so, it will present you a "Fill" button. Pressing that button will execute another JS script that will fill that form. In this scenario your data is send via Apple Events.
- When you have the Safari App Extension enabled, the process is similar. But instead of Secrets actively looking for logins forms on frontmost browser windows, the extension will let it know what is available. Again you will still need to press a "Fill" button on Secrets. Once you do your data is placed on a private clipboard that the extension uses to then fill the login.
There are no local servers, and the extension doesn't have access to your data. By design, none of the linked vulnerabilities would apply.
None taken ;). I understand your point of view and hopefully we can iterate on the foundation we've built and make a more compelling argument for you in the future.
By using an open standard to store your data besides being as transparent as possible on the storage format which you can verify on your own using third party tools (we have a post about that https://outercorner.com/2016/08/01/storage_format.html) we also benefit for the scrutiny OpenPGP as been through.
We also wanted to make a simpler and safer option (and in our eyes, more pleasant to look at) to existing password managers.