3 ms·

That ticket is marked as resolved and the last update is 16 years ago. Also this is the first I've heard that iCloud keychain sync only syncs keychain items cr

That ticket is marked as resolved and the last update is 16 years ago. Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I just checked the documentation for kSecAttrSynchronizable and there's no mention whatsoever of it being restricted to App Store apps.

acdha 9y ago
Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone. The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support: https://bugs.chromium.org/p/chromium/issues/detail?id=466638 https://bugs.chromium.org/p/chromium/issues/detail?id=466638
- eridius 9y ago
  Thanks. It sounds like the real problem here is the fact that iCloud keychain doesn't have an access control list so apps can only access items within their same App Group, which means Firefox can't see Safari passwords and, if Firefox switches to iCloud keychain, no other browser can read passwords from Firefox. Though honestly this doesn't sound like a big deal to me (especially since the "Firefox can't see Safari passwords" is already the situation). The Chrome bug does claim that Mac apps could not use the keychain access groups entitlement without being in the App Store but I can't find any hint of that being true today. I believe Apple relaxed the iCloud restrictions at some point so it's possible that this used to be true and isn't anymore.
  - acdha 9y ago
    It mostly annoys me that we had at least 17 years where this relatively modest amount of code would have made a big security & usability benefit. Even if Apple eventually deprecated it, that’s a longer useful lifespan than an awful lot of code has.

acdha 9y ago

Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone. The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support: https://bugs.chromium.org/p/chromium/issues/detail?id=466638 https://bugs.chromium.org/p/chromium/issues/detail?id=466638

eridius 9y ago
Thanks. It sounds like the real problem here is the fact that iCloud keychain doesn't have an access control list so apps can only access items within their same App Group, which means Firefox can't see Safari passwords and, if Firefox switches to iCloud keychain, no other browser can read passwords from Firefox. Though honestly this doesn't sound like a big deal to me (especially since the "Firefox can't see Safari passwords" is already the situation). The Chrome bug does claim that Mac apps could not use the keychain access groups entitlement without being in the App Store but I can't find any hint of that being true today. I believe Apple relaxed the iCloud restrictions at some point so it's possible that this used to be true and isn't anymore.
- acdha 9y ago
  It mostly annoys me that we had at least 17 years where this relatively modest amount of code would have made a big security & usability benefit. Even if Apple eventually deprecated it, that’s a longer useful lifespan than an awful lot of code has.