5 ms·

You can use a high entropy passcode for iCloud. You just can’t stay signed in when you’re not using it. I don’t understand the issue here

• Dylan16807 4y ago
  They want to use it to get signed in but not to stay signed in. It makes sense to me.
• lxgr 4y ago
  How can I select a high-entropy iCloud passcode without also making my phone unlock code high-entropy?
  • yunwal 4y ago
    To change your iCloud passcode: https://support.apple.com/en-us/HT201355 https://support.apple.com/en-us/HT201355 To change your phone passcode: https://support.apple.com/guide/iphone/set-a-passcode-iph14a867ae/ios https://support.apple.com/guide/iphone/set-a-passcode-iph14a...
    • lxgr 4y ago
      > To change your iCloud passcode: https://support.apple.com/en-us/HT201355 https://support.apple.com/en-us/HT201355 That's only the Apple ID/iCloud/account password, which plays only a minor role in end-to-end encryption. The phone passcode is the (secret which gates, on Apple's HSMs,) your iCloud encryption key! https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for... Got "1234" as a passcode on a long-forgotten family iPad or test iPhone? Better go change it to something secure, as that's what stands between an advanced attacker (that can compromise your 2FA), or somebody able to compromise/apply sufficient pressure to Apple, getting into your iCloud end-to-end encrypted data.
      • sebk 4y ago
        The iCloud recovery key is a 28-character string, not your iPhone PIN: https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072. There is no situation that I can think of where a device PIN is of any use off-device.
        • lxgr 4y ago
          Recovery keys were part of iCloud Keychain end-to-end encryption when used without "two-factor authentication", which is now a deprecated setup and can't be used with new iCloud accounts anymore: https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/web https://support.apple.com/guide/security/secure-icloud-keych... (describes how both approaches work) https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 (documents that two-factor authentication is now effectively mandatory, which makes using recovery keys impossible) The device PIN is now exclusively used (off-device!) for iCloud end-to-end encryption key recovery: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for...
          • sebk 4y ago
            Thank you for the links. In my case, I have two-factor _and_ a recovery key set up. The Account Recovery icon on Apple ID says "Your device passcodes can be used to recover end-to-end encrypted data. If you forget your passcodes, you'll need a recovery contact or recovery key." Are you sure it's either/or? Have you gone through the process, and are you sure the PIN is required off-device, rather than ? If that's the case, I do agree that it's not good. Also I don't quite understand the threat model where a stronger authentication to iCloud allows for weaker data encryption. Considering Apple is usually pretty spot on with these things, this would definitely stick out.
            • deleted 4y ago
              [deleted]
      • shbooms 4y ago