Fifteen years ago this month, Michael Sippey published Two Minutes With Steve, looking back on the day he and his colleague Ray Marshall demoed TypePad’s iPhone app on stage at Apple’s Worldwide Developers Conference. They had two minutes. Ray is our founder – the person who went on to build mSecure.

Steve Jobs changed what was possible for small software companies. The App Store opened in 2008, weeks after that keynote, and a small team suddenly had the same shelf as everyone else – that same storefront, on the same phone, whether you were ten people or ten thousand. mSecure exists because of that, and so do thousands of companies like it.

One detail in Sippey’s piece has stuck with us ever since, because it describes exactly the part of building software that nobody sees — and for a password manager, that part is most of the job.

 

What happened in 2008

At Apple’s Worldwide Developers Conference that June, the iPhone SDK was new and the App Store had not opened yet. Outside developers were invited to show, on stage, what the thing could do. Each got two minutes.

Two minutes each. The preparation ran forty to fifty hours.

It started a week early, at Apple’s campus, with a script the team thought was finished. It wasn’t. Apple’s people rewrote it with them, reshaped the story, and ran it again and again – “Better. Now do it again” is how Sippey remembers the refrain going. Then came a dress rehearsal in Apple’s own theater for Jobs, Scott Forstall and Phil Schiller, who would decide whether the demo made it to the keynote at all.

 

The part that stuck

They passed. Jobs liked it, and gave notes – move a line up, emphasize this, fix that button. Then he tilted his head and asked whether the photos in the demo were stock photos.

They were. Of course they were. Placeholder pictures, on screen for a few seconds, in a demo that had already survived a week of rehearsal and the notes of three Apple executives. The kind of detail everyone involved had long since agreed to stop seeing.

“Don’t worry,” he said. “We can get you photos. We have great photos.”

By the weekend the demo phones were loaded with Apple’s own.

That is the detail we keep coming back to. Not the keynote, not the stage. The fact that in the last review before the biggest product event of the year, someone noticed the placeholder art – and fixed it, on behalf of a company that wasn’t his.

What attention to detail looks like here

That standard is easy to admire and hard to keep. Here is roughly what it costs us, in small things you will probably never notice.

Password History keeps your previous passwords, so changing one is never destructive. On iPhone and iPad the icon that opens it sits visible in the record. On desktop it appears when you hover. That is two different pieces of design work for one feature, because the right answer on a touch screen is not the right answer with a cursor, and splitting the difference would have been worse on both.

AutoFill has to decide whether the site you are on is the site a record belongs to. That sounds trivial until you look at the cases: a bank that sends you to a separate domain to sign in, a service with a dozen regional variants, an address built to be mistaken for one you trust. Err one way and AutoFill never offers the right record, and you go back to copying and pasting. Err the other and it offers your credentials to a site that merely resembles the real one.

The Security Center flags weak, reused and aging passwords. Each of those is a separate judgement about what “weak” means, and each gets revisited when the guidance moves – which it does. Password rules that were best practice ten years ago are now the ones security researchers tell you to stop following.

None of that shows up on a feature list in a way that would make you pick us. It is the stock-photo category of work: invisible when it is right, and the only thing you see when it is wrong.

Why it matters more for us than for most

For a password manager, the invisible work is not a nice extra. It is the entire product.

You cannot inspect our encryption. You cannot audit our sync. You will never see the decisions behind how long a session stays unlocked, or what happens to a record when two devices disagree about it. You hand over every credential you own and take it on faith that the care went in where you cannot look.

The only honest signal anyone can offer you is the part you can see. Whether the small details are right. Whether the thing behaves sensibly when you do something unexpected. Whether anyone cared about the placeholder art.

When John Gruber wrote about Jobs stepping down, he said his greatest creation was Apple itself – not a product, but a company that worked a certain way. Fifteen years on, that is still the part worth copying. Not the showmanship. The forty-nine hours before it.

If you want to see the small stuff for yourself, start with Your 15-Minute Password Health Check.