Hands-on with OS X Mavericks: Safari and iCloud Keychain

Sure, Safari is its own app, but new OS X versions tend to bring new versions of Safari, and Mavericks is no exception. Safari 7 offers a new sidebar, plug-in management, a redesigned Top Sites page, performance improvements, and a new feature designed to remember your passwords without compromising security.

Sidebar full of links

The Mountain Lion version of Safari offered three features that could be accessed via buttons on the far left side of what it called the Bookmarks Bar: Reading List, Bookmarks, and Top Sites. Safari 7’s newly rechristened Favorites Bar features only two: Sidebar (which somewhat confusingly still uses the Bookmarks icon of an open book) and Top Sites.

The new Sidebar is the new home of Bookmarks, Reading List, and the new Shared Links feature. It’s a gray bar (minimum width: 300 pixels) that lives on the left side of the browser window. To open it, click on that book-shaped Sidebar icon on the toolbar, or choose Show Bookmarks Sidebar, Show Reading List Sidebar, or Show Shared Links Sidebar from the View menu. (There are also keyboard shortcuts—Command-Control-1, 2, and 3, respectively. You can toggle the Sidebar on and off by pressing Command-Shift-L.)

In previous versions of Safari, going to the Bookmarks view replaced the contents of your browser window with a bookmark editor, where you could drag and drop bookmarks and rename them. That window is still there if you choose Show Bookmarks from the Bookmarks menu, though it’s now a hierarchical view full of folders, instead of the weird old interface where different folders were in a separate sidebar of their own. If you want to do organizational work on your bookmarks, this is still where you need to go.

But in parallel there’s this new Bookmarks tab in the Sidebar, which gives you one-click access to your bookmarks. Just click on a bookmark in the Sidebar, and Safari loads that page on the right side of the same window. Click on a folder to show or hide its contents. You can drag items around can edit them by Control-clicking on them and choosing Rename Bookmark or Edit Address. You can change the name by clicking and holding for a few seconds. There’s also a search box above the top of the list, if you need to find a specific bookmark.

The new Bookmarks tab seems like a nice approach for people who want one-click access to more bookmarks than will fit on the Favorites Bar, or as an alternative for people who simply prefer the Sidebar to the Favorites Bar. And it’s a much more accessible way to organize your bookmarks than the old view. As for me, my Favorites Bar handles my most important bookmarks just fine, and the Bookmarks menu does a decent job with the rest. I’m not sure I’ll be spending a lot of time in the Bookmarks tab of the Sidebar.

The second tab in the Sidebar is Reading List, and it’s not that different from the Mountain Lion version. This is still the place where you can collect pages on the Web that you want to read at a later time, even if you’re offline. The big difference in Safari 7 is that the Reading List scrolls endlessly. Once you’re at the bottom of a Reading List story, just keep scrolling down and you’ll be taken to the next story in the list.

In previous iterations of Safari, there were toolbar buttons to add stories to Reading List and add links to your Bookmarks. In Mavericks, Safari no longer provides those buttons. Instead, there’s a big plus (+) button integrated to the Address and Search bar, just to the left of the page’s URL. Click the plus button to add the page you’re on to Reading List; click and hold to see a menu of options, including adding the page to Reading List, Top Sites, or filing it as a bookmark in any of your bookmark folders.

Now to the third (and most interesting) addition to the Sidebar: the Shared Links tab. Once you’ve logged in to a Twitter or LinkedIn account via the Internet Accounts (formerly Mail, Contacts and Calendars) system preference pane, any posts that contain hyperlinks are displayed in the Shared Links list. If you truly use your Twitter stream as a replacement for RSS feeds, Shared Links is a concentrated burst of Twitter linkage that eliminates the middleman.

In the Shared Links sidebar, posts are displayed with the most recent item at the top. They aren’t bare links, either—you see the avatar of the person who posted the link, their name, an icon representing the service the post came from (just Twitter or LinkedIn are supported at this point), and the text of the post itself. Click anywhere on the post to display it in the browser window, and like Reading List, if you keep scrolling to the bottom of the story, you’ll be able to scroll right on to the next story in the list.

As you read a story, the original post that spawned it remains at the top of the screen, so you can quickly find the answer to the question, “Which one of my friends thought this was worth Tweeting about?” There’s also a Retweet button, so if you do approve of the story, you can pass it on.

Shared Links is a great idea, and I’ve been using it a lot. I am one of those people who uses Twitter as a source for many of my links. That’s not to say there aren’t issues: The light-gray-text-on-darker-gray-background color scheme makes the text of individual posts hard to read, and there are no timestamps. You also can’t “pull to refresh” in order to see new posts, à la Twitter’s own client app, and Safari itself doesn’t appear to update content rapidly. If I want to see new links, I need to open and close the Sidebar or choose Update Shared Links from the View menu. It’s also too bad that Facebook links aren’t an option, though given the junk littering my Facebook feed these days, maybe it’s just as well?

Next to the Sidebar button is the Top Sites button, and of course there’s a new version of the Top Sites interface, which presents you with six or 12 or 24 of your favorite sites in a grid. (It’s now a proper Hollywood Squares/Brady Bunch style grid, with none of the curved-wall effects of the previous iteration of Top Sites.) I admit I never use Top Sites (my default window: Empty Page), but the look seems more modern and drag-and-drop reorganization of Top Sites items is a no-brainer addition.

Faster, lighter, safer?

When Apple unveiled Mavericks at WWDC, it said that it would deliver the fastest JavaScript experience around. The browser certainly feels fast, though when I ran the synthetic SunSpider benchmark it was slower than Chrome. However, it beat Chrome on the JSBench suite, which plays back real-world JavaScript functions. We’ll see how performance is in the final, release version, but I’m optimistic.

Apple also says that Safari has a bunch of new under-the-hood features that improve speed, reliability, and security. Separate pages run in separate processes and there’s improved memory efficiency, and the browser takes advantage of power-saving features of Mavericks to run more efficiently. I haven’t been able to test any of these claims yet.

One major source of stability, speed, and energy-consumption issues in Safari isn’t actually Safari itself—it’s browser plug-ins such as Adobe Flash. Third-party tools like ClickToPlugin have let users manage whether webpages can load those plug-ins, and in Mavericks, Safari has a similar feature built right in.

The feature lives in the Security tab of Safari’s preferences window, under the Manage Website Settings button. From here you can see every browser plug-in being used by your system and a list of sites that have loaded it. You can turn access on and off on a per-site basis, as well as set a default for what happens on your first visit to a website that’s trying to load a plug-in. For example, you can set YouTube to always load Flash, but all other sites to block Flash on first load.

Safari’s also got a Power Saver feature that will sometimes prevent plug-ins from loading until you click, emulating ClickToPlugin’s approach. I wish that Safari went further, though, and allowed the Manage Websites Settings option to set certain plug-ins to only load on a click, somewhere between a pure block and actually loading the plug-in.

And when Safari’s blocking a plug-in, the browser replaces the space occupied by the plug-in with an empty box. This happens because Safari’s reporting to the web server that it has the plug-in, but doesn’t show the content. Some sites offer non-Flash equivalents if a device (such as an iPhone or iPad) doesn’t have Flash, but Safari doesn’t see those if Flash is installed but disabled.

iCloud Keychain arrives

I’ve been a user of 1Password for a few years now, and I love it. I remember a single password, and 1Password remembers my passwords, personal information, credit-card numbers, and enters them into my web browser when I tell it to.

The moment the new Mavericks feature called iCloud Keychain was announced, plenty of wags (probably including me) suggested that Apple had “ Sherlocked” 1Password. I’m not sure I agree with that; iCloud Keychain does some, but not all, of what 1Password does. In typical Apple fashion, it will probably satisfy a large group of casual users while the more advanced users turn up their noses and continue to use 1Password instead.

In any event, iCloud Keychain stores your passwords, credit-card numbers, and personal contact information and syncs them between devices running Mavericks or the also-forthcoming iOS 7. Since it’s all synced via iCloud, it should all stay in sync, so if you save a password on your Mac, it’ll be there when you next visit that site on your iPad. Pretty cool. (This is an optional feature—nobody’s forcing you to put your stuff in the cloud. You turn it on by checking the Keychain box in the iCloud system-preference pane.)

Apple’s got some major advantages over utilities like 1Password, in that it can integrate directly in the browser (rather than via an extension) on the Mac. Passwords and user names fill in automatically when you visit a page, so you don’t have to click around like you do with 1Password. On iOS, the situation is even starker, since there are no such things as iOS browser extensions. 1Password is, as a result, a lot less convenient on iOS—and presumably iCloud Keychain will work seamlessly inside of Safari on iOS.

Safari’s been able to remember your password for ages now (only the syncing part is new), but it will now also suggest a random password for you when you’re prompted to create one. (This is good, because simple passwords are insecure.) Then Safari will save the random password in the keychain, so you never have to remember it. Safari can also remember your credit-card information and automatically fill it (well, most of it—it won’t store your card’s security code, which Apple says “is in accordance with industry practice” and I say is a silly practice) when you want to buy something.

I’m also a little concerned about the fact that, when my Mac is on, every password is available to anyone who uses my Mac. If you’re concerned that other people will have access to your passwords and credit-card numbers (but not the credit card’s security code!), you’ll need to set your Mac to automatically lock when it goes to sleep or when the screen saver activates, and set a very low timeout before that happens. I think I’d prefer an option to have to enter a password to unlock my iCloud Keychain. You can set the Mac’s normal keychain to lock after a period of inactivity, but the iCloud Keychain can’t be set to auto-lock. That seems like an oversight to me. Is the iCloud Keychain so secure that it doesn’t need its own separate password lock, or so insecure that it can’t be trusted to hold your credit card’s four-digit security code?

Surf’s up

I can quibble with some of the details, but I have to say that I’m impressed with the Safari update for Mavericks. Shared Links is a good idea that I keep finding myself using, and iCloud Keychain adds a level of convenience (especially once it’s paired with iOS 7) that’s hard to beat. Plus, any tool that discourages the use of passwords like “password123” makes the world a better place.

[Update 7/12, 9:20 a.m.: Updated to reflect that bookmarks in the sidebar are editable. 9:45 a.m.: Added note about iCloud keychain being optional.]