4 ms·
If an attacker has access to the device and passcode, they already can view all the data on it including the keychain. Right? So the concern here is just that A
by abalone 9y ago
If an attacker has access to the device and passcode, they already can view all the data on it including the keychain. Right? So the concern here is just that Apple has made it easier for attackers with access to a device and passcode to exfiltrate in bulk instead of piece by piece via the UI.
In exchange for letting people reset their encrypted backup password without losing data.
How is that a "horror story"?
- fpgaminer 9y agoNo I don't believe you can view the keychain on an iPhone. Hence why the backup is necessary.
- zaroth 9y agoBut you could, for example, install a Trusted CA Cert and mitmproxy the connection to sniff the Google password as it’s used to login. Same with stored credit cards, etc.
- abalone 9y agoOh you sure can. Settings > Accounts & Passwords > App & Website Passwords Settings > Safari > Autofill > Saved Credit Cards
- fpgaminer 9y agoI stand corrected. To nitpick, there is more data in the keychain than passwords and credit cards. But I think having all your passwords and credit cards exposed is probably bad enough.