2

I have too many passwords to track on too many devices. With my apple devices & services, it would be easier for me if both my iCloud and Apple ID passwords were the same.

Should this be ok or is it bad security practice? Is there a recommendation? What do most people do?

  • Not great for security, great for remembering which is which. I have 2 Apple IDs, one from long before iCloud was ever dreamed up. Until I made the passwords AND security questions the same I was forever getting locked out. – Tetsujin Feb 11 '15 at 7:56
  • this may be of interest apple.stackexchange.com/questions/59974/… – Jaime Santa Cruz Jun 16 '15 at 4:48
2

First, you usually don't need a different Apple ID for iCloud:

We recommend that you use the same Apple ID for Store purchases and iCloud. Using multiple Apple IDs might be confusing and might cause issues with accessing purchased content or using some services.

If you do have two Apple ID's, Apple has this to say about reusing passwords:

Avoid using your Apple ID password with other online accounts.

Password reuse is problematic because all your security depends on the "weakest link", the less secure –or more exposed– service. Once that service is compromised, all your services are.

XKCD has this to say about the subject:

XKCD Password reuse comic

On the matter of remembering passwords, XKCD –sorry, again– has some iconic graphical input, analyzed and validated here by the people at InfoSec SE.

XKCD password strenght

In a nutshell, passwords must be difficult to guess and easy to remember, and he proposes the use of passphrases instead of short, complicated passwords.

Yet others think that

The Only Secure Password Is the One You Can’t Remember

which is my philosophy by the way.
In order to achieve this apparent nonsense, you use a Password manager, (iCloud Keychain, Keepass, 1Password, LastPass), and generate different random secure passwords for every service. You only have to remember one master password –where you could apply XKCD's idea.

People have different opinions on how secure password managers are; if you are a bit paranoid or have very sensitive data you may want to have an eidetic memory instead, although one known cryptographer and security expert advocates the use of at least one –not cloud synced, though.

  • However normal apple ids (those that end with gmail.com) have limited features (can't access mail/notes/etc) in iCloud. We'd still need a @icloud account. – Pacerier Oct 19 '15 at 22:05
  • 1
    @Pacerier I haven't heard of this "normal" Apple IDs you describe. I don't think I understand the second part of your assertion. – Jaime Santa Cruz Nov 2 '15 at 22:50
  • Is your Apple Id username ending with @ icloud or one that doesn't? – Pacerier Nov 29 '15 at 3:13
  • It does not end on @ icloud.com – Jaime Santa Cruz Nov 29 '15 at 3:29

You must log in to answer this question.

protected by bmike Nov 5 '16 at 16:09

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .