6 ms·

What happens if you lose your device or it breaks or something? Do you lose access to anything tied to it?

xmdx 4y ago
They said in the event that everything is synced on iCloud so all your devices can use the keys, which makes me think no, it's just a password manager, without the password bit. Maybe they create a separate key for each device, but then why mention iCloud syncing at all.
- howinteresting 4y ago
  It's a password manager with cryptographic vendor lockin. There are definitely some benefits though, such as immunity from phishing. Surely we as the industry can bring them about in a way that doesn't involve cryptographic vendor lockin.
  - vorpalhex 4y ago
    The secrets can be exported - whether or not they will allow that though...
  - altairprime 4y ago
    The industry doesn’t seem to have a working software solution for mobile phone authentication secrets that both is 1) immune to persuading a user to export their data (to get phished), and 2) allows a user to export their data at any time (to prevent lock-in). What would it look like to do #2 safely, without enabling the phishing that we see today with #1?
    - danShumway 4y ago
      I get where you're coming from and you're not wrong, but at the same time, I don't buy this as an excuse for vendor lock-in here, because it seems like Apple is already backing up passkeys to iCloud. If Apple has decided that the risk of getting your passkeys phished out of your Apple iCloud Account is outweighed by the benefit of users being able to restore/sync login details immediately when they buy a new iOS device and log into it, then I think it's reasonable for users to expect the same treatment and the same experience when they're moving away from iOS. If Apple wasn't backing up any of the logins, and they had committed to when you trade in your phone and upgrade to the latest iPhone forcing you to manually re-create all of those keys one-by-one using your recovery option, then I'd accept not having an export option for Android/Linux/Windows. Otherwise, it will just seem really suspiciously convenient to me if they ultimately decide that exporting keys is acceptable risk unless it's to a competitor's device. As far as I can tell, there hasn't been any official confirmation that users won't be able to export them to non-iOS devices, so maybe it's all worry over nothing. But I don't think security is a justification to apply restrictions specifically only on devices outside of Apple's ecosystem.
      - altairprime 4y ago
        I don't consider this solution an excuse for vendor lock-in. I consider this a problem that has no known solutions without vendor lock-in. If you offer users a way to export, then you offer phishers a way to social engineer users. So either you prevent social engineering (lock-in: yes), or you allow exports (lock-in: no). Which choice has a higher precedence when serving the market of "non-technical mobile phone users"?
        howinteresting 4y ago
        You can offer to transfer data to another computer or phone that's plugged into yours over USB.
        altairprime 4y ago
        Your choice is to allow people to be phished for credentials, then. Gullible people will cheerfully complete any attacker-described PC syncing process, ignoring every security warning presented to them, in order to give away the keys to their accounts. They’ll use a friend’s PC, or a library PC, or anything under the sun, if the phished promises to give them something for nothing.
        danShumway 4y ago
        Apple is already remotely backing up passkeys off-device. We are having a debate about an Apple policy that doesn't exist. Apple is not following the "keys never leave your device" model, so that security model has nothing to do with whether or not Apple will engage in vendor lock-in. We're not making the choice to leave users vulnerable to phishing attacks, Apple made that choice, and we're arguing that because they made that choice they have no excuse to also engage in vendor lock-in.
        altairprime 4y ago
        As far as I know, Apple requires iCloud password and PIN entry on an Apple hardware device being paired to iCloud to access Keychain data, and tends to block Apple devices by hardware ID when they’re associated with bulk login attacks. The attacker surface for phishers is exorbitantly expensive, since they’d need to have a shipping container full of iPhones to even begin harvesting credentials, assuming that they could convince users to turn over their iCloud password (which half of my friends don’t even know). This is how vendor lock-in allows protections against phishing that a naive data export would bypass. No one has yet suggested how this level of protection can be offered to end users without lock-in, across many such posts and threads, for many years now. I remain hopeful that there’s another way, but I’m not going to demand Apple do insecure exports at the expense of users in the meantime.
  - theluketaylor 4y ago
    There is no password so it can't be a password manager. Without a password it avoids all the downsides of passwords like having to store them securely on both ends, rainbow tables, credential reuse, weak password choice, and having to remember them. It's a cryptographic keypair manager. Key management is always the barrier to really good real world cryptography, so I'm heartily in favour. Anything that makes it possible for regular people to use strong cryptography is a huge win. Since it's all just FIDO2/webauthn under the hood it's hardly lockin. It's a bit of Apple UI tinsel to make life simple and their excellent icloud keychain sync.
FollowingTheDao 4y ago
I would guess you could not sign into it on another computer, right? They must have considered this because that's would be a huge hassle.
snowwrestler 4y ago
I think Apple encrypts the pass keys locally on your device, then stores encrypted copies in iCloud, which you can download and decrypt on a new device. On the new device you would be prompted for the passcode of the device you lost or broke, to decrypt and access them.
- gzer0 4y ago
  iCloud (and anything on iCloud) is explicitly not encrypted, though [1]. [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - macintux 4y ago
    That’s not universally true. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 > If you forget your password or device passcode, iCloud Data Recovery Service can help you decrypt your data so you can regain access to your photos, notes, documents, device backups, and more. Data types that are protected by end-to-end encryption—such as your Keychain, Messages, Screen Time, and Health data—are not accessible via iCloud Data Recovery Service.
  - ddoolin 4y ago
    Literally in the article: > Instead of protecting all of iCloud with end-to-end encryption, Apple has shifted to focus on protecting some of the most sensitive user information, such as saved passwords and health data. > But backed-up contact information and texts from iMessage, WhatsApp and other encrypted services remain available to Apple employees and authorities.
  - vngzs 4y ago
    This is false; some data is end-to-end encrypted, including Health and Keychain data. Photos, contacts, and Drive are "encrypted on server" which means Apple can read them. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - deleted 4y ago
blktiger 4y ago
It's tied to a key stored in your iCloud. So basically as long as you have a device tied to your iCloud you can get in. Presumably, if you lose access to iCloud you will have problems.
- willis936 4y ago
  Apple is the face on the screen. There is no lady with a hammer. https://youtu.be/OYecfV3ubP8 https://youtu.be/OYecfV3ubP8
  - threeseed 4y ago
    This is based on an open standard and is entirely optional. So your analogy makes absolutely no sense.
    - willis936 4y ago
      It's a metaphor. Semantics aside, holding private keys hostage with no recourse is Orwellian. A for-profit company has no business being a centralized identity authority.
- cokeandpepsi 4y ago
  What happens when you're not using an apple device?
  - MBCook 4y ago
    I saw a screenshot. Somehow a QR code is presented and you scan that with your phone. I’m not entirely sure what happens from there. But there was a picture of them using it with a Windows machine. So they’ve thought of it.
    - cokeandpepsi 4y ago
      interesting, but it still needs an iPhone> -- I was kind of burned hard when trying to migrate my iCloud keychain passwords to something else so I'm curious how smooth it actually is
babypuncher 4y ago
It sounds like your private keys are stored in iCloud, so they should be accessible on a new device as long as you remember your Apple ID, password, the device-specific PIN/passcode from your old phone.
gruez 4y ago
Same thing that happens if your FIDO/U2F key breaks. If you have a backup key (or in the case of this implementation, icloud backup), then it shouldn't matter. Otherwise you're at the mercy of the site that's requesting the credentials. They might allow you to authenticate via another method (security questions?), or lock you out permanently.
- toomuchtodo 4y ago
  Ideally, if you can’t identity proof in person, recovery flow should be Stripe Identity or another proofing system that will consume government ID and output pass or fail. It’s the next best thing to showing up in person and having a human proof you, and saying “oops keys all gone” isn’t going to fly for the masses at scale.

xmdx 4y ago

They said in the event that everything is synced on iCloud so all your devices can use the keys, which makes me think no, it's just a password manager, without the password bit. Maybe they create a separate key for each device, but then why mention iCloud syncing at all.

howinteresting 4y ago
It's a password manager with cryptographic vendor lockin. There are definitely some benefits though, such as immunity from phishing. Surely we as the industry can bring them about in a way that doesn't involve cryptographic vendor lockin.
- vorpalhex 4y ago
  The secrets can be exported - whether or not they will allow that though...
- altairprime 4y ago
  The industry doesn’t seem to have a working software solution for mobile phone authentication secrets that both is 1) immune to persuading a user to export their data (to get phished), and 2) allows a user to export their data at any time (to prevent lock-in). What would it look like to do #2 safely, without enabling the phishing that we see today with #1?
  - danShumway 4y ago
    I get where you're coming from and you're not wrong, but at the same time, I don't buy this as an excuse for vendor lock-in here, because it seems like Apple is already backing up passkeys to iCloud. If Apple has decided that the risk of getting your passkeys phished out of your Apple iCloud Account is outweighed by the benefit of users being able to restore/sync login details immediately when they buy a new iOS device and log into it, then I think it's reasonable for users to expect the same treatment and the same experience when they're moving away from iOS. If Apple wasn't backing up any of the logins, and they had committed to when you trade in your phone and upgrade to the latest iPhone forcing you to manually re-create all of those keys one-by-one using your recovery option, then I'd accept not having an export option for Android/Linux/Windows. Otherwise, it will just seem really suspiciously convenient to me if they ultimately decide that exporting keys is acceptable risk unless it's to a competitor's device. As far as I can tell, there hasn't been any official confirmation that users won't be able to export them to non-iOS devices, so maybe it's all worry over nothing. But I don't think security is a justification to apply restrictions specifically only on devices outside of Apple's ecosystem.
    - altairprime 4y ago
      I don't consider this solution an excuse for vendor lock-in. I consider this a problem that has no known solutions without vendor lock-in. If you offer users a way to export, then you offer phishers a way to social engineer users. So either you prevent social engineering (lock-in: yes), or you allow exports (lock-in: no). Which choice has a higher precedence when serving the market of "non-technical mobile phone users"?
      - howinteresting 4y ago
        You can offer to transfer data to another computer or phone that's plugged into yours over USB.
        altairprime 4y ago
        Your choice is to allow people to be phished for credentials, then. Gullible people will cheerfully complete any attacker-described PC syncing process, ignoring every security warning presented to them, in order to give away the keys to their accounts. They’ll use a friend’s PC, or a library PC, or anything under the sun, if the phished promises to give them something for nothing.
        danShumway 4y ago
        Apple is already remotely backing up passkeys off-device. We are having a debate about an Apple policy that doesn't exist. Apple is not following the "keys never leave your device" model, so that security model has nothing to do with whether or not Apple will engage in vendor lock-in. We're not making the choice to leave users vulnerable to phishing attacks, Apple made that choice, and we're arguing that because they made that choice they have no excuse to also engage in vendor lock-in.
        altairprime 4y ago
        As far as I know, Apple requires iCloud password and PIN entry on an Apple hardware device being paired to iCloud to access Keychain data, and tends to block Apple devices by hardware ID when they’re associated with bulk login attacks. The attacker surface for phishers is exorbitantly expensive, since they’d need to have a shipping container full of iPhones to even begin harvesting credentials, assuming that they could convince users to turn over their iCloud password (which half of my friends don’t even know). This is how vendor lock-in allows protections against phishing that a naive data export would bypass. No one has yet suggested how this level of protection can be offered to end users without lock-in, across many such posts and threads, for many years now. I remain hopeful that there’s another way, but I’m not going to demand Apple do insecure exports at the expense of users in the meantime.
- theluketaylor 4y ago
  There is no password so it can't be a password manager. Without a password it avoids all the downsides of passwords like having to store them securely on both ends, rainbow tables, credential reuse, weak password choice, and having to remember them. It's a cryptographic keypair manager. Key management is always the barrier to really good real world cryptography, so I'm heartily in favour. Anything that makes it possible for regular people to use strong cryptography is a huge win. Since it's all just FIDO2/webauthn under the hood it's hardly lockin. It's a bit of Apple UI tinsel to make life simple and their excellent icloud keychain sync.

FollowingTheDao 4y ago

I would guess you could not sign into it on another computer, right? They must have considered this because that's would be a huge hassle.

snowwrestler 4y ago

I think Apple encrypts the pass keys locally on your device, then stores encrypted copies in iCloud, which you can download and decrypt on a new device. On the new device you would be prompted for the passcode of the device you lost or broke, to decrypt and access them.

gzer0 4y ago
iCloud (and anything on iCloud) is explicitly not encrypted, though [1]. [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- macintux 4y ago
  That’s not universally true. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 > If you forget your password or device passcode, iCloud Data Recovery Service can help you decrypt your data so you can regain access to your photos, notes, documents, device backups, and more. Data types that are protected by end-to-end encryption—such as your Keychain, Messages, Screen Time, and Health data—are not accessible via iCloud Data Recovery Service.
- ddoolin 4y ago
  Literally in the article: > Instead of protecting all of iCloud with end-to-end encryption, Apple has shifted to focus on protecting some of the most sensitive user information, such as saved passwords and health data. > But backed-up contact information and texts from iMessage, WhatsApp and other encrypted services remain available to Apple employees and authorities.
- vngzs 4y ago
  This is false; some data is end-to-end encrypted, including Health and Keychain data. Photos, contacts, and Drive are "encrypted on server" which means Apple can read them. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- deleted 4y ago

blktiger 4y ago

It's tied to a key stored in your iCloud. So basically as long as you have a device tied to your iCloud you can get in. Presumably, if you lose access to iCloud you will have problems.

willis936 4y ago
Apple is the face on the screen. There is no lady with a hammer. https://youtu.be/OYecfV3ubP8 https://youtu.be/OYecfV3ubP8
- threeseed 4y ago
  This is based on an open standard and is entirely optional. So your analogy makes absolutely no sense.
  - willis936 4y ago
    It's a metaphor. Semantics aside, holding private keys hostage with no recourse is Orwellian. A for-profit company has no business being a centralized identity authority.
cokeandpepsi 4y ago
What happens when you're not using an apple device?
- MBCook 4y ago
  I saw a screenshot. Somehow a QR code is presented and you scan that with your phone. I’m not entirely sure what happens from there. But there was a picture of them using it with a Windows machine. So they’ve thought of it.
  - cokeandpepsi 4y ago
    interesting, but it still needs an iPhone> -- I was kind of burned hard when trying to migrate my iCloud keychain passwords to something else so I'm curious how smooth it actually is

babypuncher 4y ago

It sounds like your private keys are stored in iCloud, so they should be accessible on a new device as long as you remember your Apple ID, password, the device-specific PIN/passcode from your old phone.

gruez 4y ago

Same thing that happens if your FIDO/U2F key breaks. If you have a backup key (or in the case of this implementation, icloud backup), then it shouldn't matter. Otherwise you're at the mercy of the site that's requesting the credentials. They might allow you to authenticate via another method (security questions?), or lock you out permanently.

toomuchtodo 4y ago
Ideally, if you can’t identity proof in person, recovery flow should be Stripe Identity or another proofing system that will consume government ID and output pass or fail. It’s the next best thing to showing up in person and having a human proof you, and saying “oops keys all gone” isn’t going to fly for the masses at scale.