3 ms·

> So what’s actually changed other than not having to go through the whole iCloud Backup/Wipe/Restore in order to reset the iTunes Backup Password? Prior to iO

> So what’s actually changed other than not having to go through the whole iCloud Backup/Wipe/Restore in order to reset the iTunes Backup Password? Prior to iOS 11, to get access to a backup of an iDevice (and that backup allows you to view all data on the device, keychain etc): 1) iCloud Backup 2) Wipe 3) Restore [requires iCloud password] 4) Perform iTunes Backup Now under iOS 11 it's (according to the article): 1) Reset Settings [requires pin code] 2) Perform iTunes Backup So the difference is that now you don't need the iCloud password.

zaroth 9y ago
Thank you for clarifying! If you disable iCloud Keychain, sign out of an iCloud account and then log into a different iCloud account on the same iPhone — what happens to the local keychain data?
- zaroth 9y ago
  From Apple documentation; What happens when I turn off iCloud Keychain on a device? When you turn off iCloud Keychain for a device, you're asked to keep or delete the passwords and credit card information that you saved. If you choose to keep the data, it isn't deleted or updated when you make changes on other devices. And then... When you turn on iCloud Keychain, any previously-saved website usernames and passwords, Wi-Fi networks, and Internet accounts are automatically included in iCloud Keychain. https://support.apple.com/en-us/HT204085 https://support.apple.com/en-us/HT204085
abalone 9y ago
If an attacker has access to the device and passcode, they already can view all the data on it including the keychain. Right? So the concern here is just that Apple has made it easier for attackers with access to a device and passcode to exfiltrate in bulk instead of piece by piece via the UI. In exchange for letting people reset their encrypted backup password without losing data. How is that a "horror story"?
- fpgaminer 9y ago
  No I don't believe you can view the keychain on an iPhone. Hence why the backup is necessary.
  - zaroth 9y ago
    But you could, for example, install a Trusted CA Cert and mitmproxy the connection to sniff the Google password as it’s used to login. Same with stored credit cards, etc.
  - abalone 9y ago
    Oh you sure can. Settings > Accounts & Passwords > App & Website Passwords Settings > Safari > Autofill > Saved Credit Cards
    - fpgaminer 9y ago
      I stand corrected. To nitpick, there is more data in the keychain than passwords and credit cards. But I think having all your passwords and credit cards exposed is probably bad enough.

zaroth 9y ago

Thank you for clarifying! If you disable iCloud Keychain, sign out of an iCloud account and then log into a different iCloud account on the same iPhone — what happens to the local keychain data?

zaroth 9y ago
From Apple documentation; What happens when I turn off iCloud Keychain on a device? When you turn off iCloud Keychain for a device, you're asked to keep or delete the passwords and credit card information that you saved. If you choose to keep the data, it isn't deleted or updated when you make changes on other devices. And then... When you turn on iCloud Keychain, any previously-saved website usernames and passwords, Wi-Fi networks, and Internet accounts are automatically included in iCloud Keychain. https://support.apple.com/en-us/HT204085 https://support.apple.com/en-us/HT204085

abalone 9y ago

If an attacker has access to the device and passcode, they already can view all the data on it including the keychain. Right? So the concern here is just that Apple has made it easier for attackers with access to a device and passcode to exfiltrate in bulk instead of piece by piece via the UI. In exchange for letting people reset their encrypted backup password without losing data. How is that a "horror story"?

fpgaminer 9y ago
No I don't believe you can view the keychain on an iPhone. Hence why the backup is necessary.
- zaroth 9y ago
  But you could, for example, install a Trusted CA Cert and mitmproxy the connection to sniff the Google password as it’s used to login. Same with stored credit cards, etc.
- abalone 9y ago
  Oh you sure can. Settings > Accounts & Passwords > App & Website Passwords Settings > Safari > Autofill > Saved Credit Cards
  - fpgaminer 9y ago
    I stand corrected. To nitpick, there is more data in the keychain than passwords and credit cards. But I think having all your passwords and credit cards exposed is probably bad enough.