I’m seeing some people misunderstand something that I think is important.

The bug in the Passwords app that led to sometimes fetching service icons over an insecure connection, which has since been fixed, could never have led to and never did lead to the phishing of password credentials due to an architecture that separates concerns.

Even when it didn’t mandate secure connections, which has been rectified, all fetches were made in a stateless fashion, with absolutely no attempt to fill or provide credentials. (You may be interested in knowing that all fetches of icons in the Passwords app are made over the privacy proxy infrastructure that powers iCloud Private Relay, even if you’re not a Private Relay user).

This was an unfortunate bug that could potentially lead to a threat actor splicing in web content fetched by the device, including icons, but phishing of passwords simply was not possible. In fact, user credentials are **never** released to apps or websites without an explicit user action.