Yesterday I drove to my local Apple Store to pick up my Mac Pro, which had had it's processor board repaired. I got there about 6:20pm, picked it up, and returned to the parking lot at 6:40. I opened the rear driver's side door, eased my Mac Pro onto the floor, and then wondered why there was broken glass on the seat. It took a moment to realize the answer -- the rear passenger side window had been smashed open. It took only a moment longer to realize the worse news -- my laptop bag, containing my MacBook Pro and iPad 2, and my camera bag containing my Canon T2i, fast 50mm lens, and 35mm lens had been stolen. Looking around I saw several other adjacent cars had been similarly broken into, and a few minutes later the owners returned and discovered similar theft of their laptops and other valuables.

I called the police. They took a report. They marked it as "will not investigate" due to the lack of cameras in the parking lot. I called my insurance company. Twice. They took a report. Twice. I called all the IT people I work with and had my passwords reset and my keys revoked and replaced.

Because I use Find my iPhone, I could try to track my iPad. (Unsuccessfully; it had been powered down.) I could also issue a remote wipe (though it would be helpful if Apple recorded the location just before it wiped). Because I keep most of my home directory in Dropbox, I didn't lose any data. (Though I dearly wish Dropbox could remote wipe the files of a lost or stolen computer -- or can it and I'm just unaware?) Because I use 1Password I can quickly replace any logins with new ones that are just as gnarly, just in case.

I wish I could just watch GDGT to see who adds my gear, then use Gowalla to track them down, but the truth is most stolen property is never recovered.

My car window will be replaced, good as new. Some portion of my gear will be covered by insurance, though probably not enough to replace it all. The loss of time and the feeling of violation will frustrate for a long time to come.

It did serve to remind me that, despite the inconvenience, security and redundancy are urgently important.

If you haven't installed Apple's free Find my iPhone service, do it now. If you don't have both a local backup (iTunes is fine), make one now. If you don't have a remote backup (iCloud might be fine come iOS 5), make one now. And make it a habit to run it every day or couple of days so you never lose too much data. Unlike gadgets, that's irreplaceable. (I'd also suggest a good password manager.)

pwSafe - Password Safe for iOS is, as it's name implies, now available as a universal application for iPhone and iPad. pwSafe is a password management app that stores your passwords and allows you to sync them across devices and computers.

• Dropbox sync, fully automatic and bi-directional (in-app purchase)
• Password generation
• Universal binary - iPad, iPhone and iPod Touch optimized
• Search in all fields
• Single tap password copy to clipboard
• Multiple fields (title, username, password, URL, email and notes)
• iTunes file sharing
• Receives safes as e-mail attachments (please name your safes with a .psafe3 extension)
• Opens safes from Dropbox (free without sync)
• Multiple safes
• Unlimited passwords
• Unlimited password groups
• Open source

If you pick this one up, let us know what you think! Check out the screenshots after the break.

[Free, with in-app purchases - iTunes link]

Have an app you'd love to see featured on TiPb? Email us at iosapps@tipb.com, tell us about your app (include an iTunes link), and we'll take a look.

If someone manages to take physical possession of your iPhone and keep it long enough to Jailbreak it, enable SSH, and get access to the root, they can compromise Apple's Keychain password management system and get to your data in roughly 6 minutes.

The attack works because the cryptographic key on current iOS devices is based on material available within the device and is independent of the passcode, the researchers said. This means attackers with access to the phone can create the key from the phone in their possession without having to hack the encrypted and secret passcode.

Using the attack, researchers were able to access and decrypt passwords in the keychain, but not passwords in other protection classes.

In other words, Exchange, Google/Gmail, LDAP, VPN, Wi-Fi, and some app passwords. This assumes you -- or the company for which you have passwords -- is a high enough level target that an attacker will go through the time and effort of stealing and breaking into your iPhone (or you lose your phone and a bored hacker finds it and decides to do it for the lulz.) It's also currently being shown off in the lab, not in the wild (that we know of).

In any case, common sense and best practices dictate that if you ever have your iPhone stolen -- or you lose it -- you immediately use Apple's free Find my iPhone service to remotely wipe it (you can always restore via iTunes if you find it again or it gets returned). You should also change your account passwords and inform your IT department so your enterprise access can be changed if/as needed.

Note: None of this has anything to do with you Jailbreaking your own phone or not. This is an attack on an iPhone, regardless if it's Jailbroken or not, that uses Jailbreak to gain access to the iPhone to steal data. Same exploit, evil intentions.

Hopefully Apple's new security muscle gets more serious about protecting the Keychain in future versions of iOS.

[PCWorld]

During WWDC 2010 I had a chance to sit down with the team from Agile Web Solutions -- Roustem, Dave, Jamie, Dan, and Chad -- to talk not only about their newly launched 1Password for iPad, but about the big news of the show including official browser extension support from Apple in Safari 5, and of course iPhone 4 and iOS 4.

Apple called Agile about their new Safari 5 extensions before they debuted in hopes of having a demo ready for the show. Dave found the preview was polished and well documented and it took them only a few days to put something together. That sounds like good news not only for developers but for Safari users as well.

Agile also said making the iPad version was a chance to start from scratch and figure out how users were going to interact with the larger, wider display, and with the ability to do things like scrolling independently with each thumb.

While I used 1Password on Mac long before the iPhone debuted, Roustem pointed out they now have a whole new user base introduced to their product via the iPhone and iPad and with no Mac-based preconceptions. While the iPhone and iPad versions [iTunes link] are great for Mac or Windows users as an extension, Agile is also working to help iPhone and iPad-only users get more out of it as well.

As for iPhone 4 -- they want it. (Even if Dan has to re-render his artwork at higher resolution to support it). Chad's also looking forward to iOS 4 multitasking and like the way it runs select API rather than full apps in the background.

(Though I suspect they were just humoring me when I asked for Game Center integration so I could see where my 63 character pseudo-random passwords place on the leaderboard compared to Leanna's!)

You can find out more about 1Password for Mac, PC, iPhone, and iPad, and the newly acquired Knox, via Agile's web site, below. Video after the break.

[Agile Web Solutions]

YouTube link

Back before the iPhone, I was using one of GRC.com's long, pseudo-random passwords for my WPA-protected Wi-Fi network. Typing it into iPhone 1.x, even iPhone 2.x was a non-starter, however, so I shrank it down considerably.

Similar security-conscious folks have lamented not only the lack of copy and paste on the iPhone, but especially the lack of "paste-into-password field" to support just those kinds of super-secure strings.

Well, it looks like we might be getting them -- along with the previously discussed copy and paste features, in iPhone 3.0.

Whether this makes it or not into the final release version is something only time will tell (because Apple, of course, isn't saying).

But we want it.