It's just full of weird, generic short-sentence LLMisms ("Detection is observation.", "Changing the password is authority.", "The security benefit is real.", "That is a meaningful improvement.", "This is not just text generation. It is an agent taking action with a sensitive credential.", ...). It doesn't offer any insights into the actual architecture that Apple came up with, whatever it might be. It doesn't propose a better design, other than a bunch of super-generic things that apply to every single software project ever ("The system should verify the exact website and account before filling or changing anything.", "This feature deserves focused adversarial testing during the beta period."). So... it's upvoted just because the title mentions Apple and AI?
Everything is so much more complicated now.
For anybody else trying to know what else the .well-known URI can hold: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...
I'd have really preferred another term: registered, reserved, defined, meta -- or really anything else.
At any rate this is just the first step towards a first-party agentic OS.
I should also add this is only if you have iOS 26 or newer.
A11y-tree alone is not enough for many sites because lots of auth stuff happens in OOPIF frames that need special handling/stitching/interactive element filtering.
There's also the issues of many captchas around auth stuff being implemented using canvas elements (that are hard to instrument for browser agents without relying on CUA). Can their on-device 3B model really handle accurate CUA driving? I guess we'll see...
It seems like this is a great way to lock oneself out of access to an account on some of the devices that they own that do not have access to the Passwords data storage.
I can see where this can be a benefit in helping users secure their accounts with stronger passwords but I think that there is a lot of potential for this to become a real problem.
And I shouldn't remember the first one, I just haven't gotten 'round to setting up the Yubikey on the laptop just yet.
this also requires the passwords app to even function. so this should be a non-issue.
So yes. It's off by default. You have to affirmatively use the feature. (This is purely based on what I remember from the demo, mind you. I have not used the feature.)
If you use this app, open it and look at how many entries fall under the “security” section. Everyday another password is compromised and added to the list, just too many to keep up. So, albeit apprehensively, I for one appreciate this feature.
A good chunk of people do use devices other than apple eco system one's and if they try to login and then suddenly, you can't!
I know. What I'm saying is, if you already trust Chrome/Safari/etc with your passwords, even trusting it to come up with one and store it securely and correctly, and it has access to the content you browse (since you're doing it through it), it's not that different from a privacy perspective.
What's gonna happen by automating the change too? It's gonna click the wrong button and delete your account?