Hi,
I'm looking to potentially move to Orion from Firefox as support for Mojave is ending there this year. So far it seems like a nice alternative, but one thing I really don't like is the language used around the password autofill and management of the app, nor in fact the way it is implemented.
I have found that the text from this suggestion was adopted verbatim. This is a very misleading and unclear explanation of what is going on with some of the most critically sensitive user data that a browser has to handle.
On first viewing it is alarming in that it states "Orion's Keychain is synced over iCloud". If you're like me and don't want your passwords being stored remotely, ever, then it's an immediate red flag, especially as there are no apparent options to disable this potential sync to the cloud. Then the question as to how this feature is implemented comes to mind. Having searched here I've since learned that there is actually no such thing as the 'Orion Keychain', and the app is simply using the Local Items keychain inside macOS. Before finding this site, I actually saw that all my passwords imported from Firefox had been placed there by Orion, what I didn't know was that this keychain turns into the iCloud keychain if you activate the syncing feature from the OS preferences (as discussed here). There have been concerns about this feature of macOS in the past, where it has turned itself on without the user choosing to do so (see: https://osxdaily.com/2024/05/28/psa-updating-to-macos-sonoma-or-ios-17-may-enable-icloud-keychain/ for example).
On top of this, the text states "Disable this option to only use system Keychain passwords". When you choose 'None' as the password provider, autofill seems to become completely disabled, no options are offered to fill the password form on sites any more. Choosing '3rd-party provider' makes a key symbol appear in the form box, but nothing is offered as an option, even when a password is available in the Local Items keychain for the site.
I would suggest that the text and behaviour be clarified to explain what is going on, and to do away with the notion of an 'Orion Keychain' which doesn't in fact exist as a separate, discrete data store. You should instead offer specific options to store passwords to a 'Local' store (never to be synced), an 'iCloud' store, or to rely on existing 'System' stores (including user Keychains like Safari can do), as well as still giving an option for 3rd-party providers (1Password etc.), which should not activate the default system keychains, as Apple is not a 3rd party to a Mac.
