3 ms·

This was precisely what drove me off Apple password manager. If your iPhone were compromised, such as in those iPhone unlocking scams[1] (something quite common

by rpgbr 4y ago

This was precisely what drove me off Apple password manager. If your iPhone were compromised, such as in those iPhone unlocking scams[1] (something quite common here in Brazil at least since 2021), it's game over for your entire password database. I've been using KeePass apps (MacPass on macOS, KeePassium no iOS), with a different, unique master password, unlogged by default on iPhone, plus DB locks automatically after 10 minutes of inactivity. Maybe I'm way off, but it seems safer to me. [1] https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas...

lxgr 4y ago
Absolutely. Given these reports, Apple's security model isn't close to being sophisticated enough to warrant trusting them with passwords or (even more critically, arguably) WebAuthN passkeys. I recently saw it with my own eyes as a family member was able to reset their iCloud password and gain full access to their account on a new device, including iCloud Keychain, using nothing but their iPad and the corresponding unlocking code. No iCloud password, no SMS-2FA (not that it would help much in the case of a stolen iPhone), nothing else.
- great_psy 4y ago
  Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
  - lxgr 4y ago
    The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device. They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys. I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.
    - great_psy 4y ago
      Ah ok, yes the shoulder surfing is definitely a problem. Hard to mitigate somebody looking over your shoulder, this is the case with most password managers, but I understand why this is a more likely scenario.
      - lxgr 4y ago
        In a semi-safe situation (e.g. on busy public transit or in a crowded place with people behind me), I do sometimes unlock my password manager using Face ID to access a website, but I'd never enter my passphrase if the biometric unlock fails. If somebody watches me enter my passcode and then rips the device out of my hands and runs off with it (assuming the password manager is not open), they now have access to most of the content on my phone, but importantly not the parts protected by Face ID, which includes the password manager. If I had used Apple's password manager instead, they'd be able to recover all passwords (using the tactics described above or simply enrolling their own face in Face ID, which is possible using only the passcode).
        balderdash 4y ago
        If you reset/create an alternate appearance for faceid does that force a manual login for the services that use it? Because your device passcode lets you change all the faceid stuff… too lazy to mess around with it myself
        lxgr 4y ago
        Apps can choose [1] to tie have keys to the current set of enrolled biometric credentials (i.e. faces or fingers), and at least my password manager does that, as far as I remember from some testing. Some apps don't, and some even react really poorly to a change of the biometric set (i.e. crashing at every Face ID use with no way to reset other than reinstalling), so I'm also not too keen on testing this on my main device. One thing that surprised me during my limited testing was that Apple apparently doesn't make use of this capability for storing the "encrypted notes" passphrase, which effectively also reduces the security of that to that of the device passcode. [1] https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/2937192-biometrycurrentset https://developer.apple.com/documentation/security/secaccess...
- __david__ 4y ago
  Incidentally this is the method my 6 year old nephew used to reset his mom’s Apple ID password so he could make in-app purchases. He figured it out on his own and then spent $3000 in a couple days. His mom had been very careful with her password but when he wanted a code on his iPad she thought it was harmless—she certainly never expected that he could get all the way to changing her password with nothing more than the lock code! Took her months to sort it out.

by rpgbr 4y ago

lxgr 4y ago

Absolutely. Given these reports, Apple's security model isn't close to being sophisticated enough to warrant trusting them with passwords or (even more critically, arguably) WebAuthN passkeys. I recently saw it with my own eyes as a family member was able to reset their iCloud password and gain full access to their account on a new device, including iCloud Keychain, using nothing but their iPad and the corresponding unlocking code. No iCloud password, no SMS-2FA (not that it would help much in the case of a stolen iPhone), nothing else.

great_psy 4y ago
Can you explain how this hack would work ? Would someone need to steal two of your devices ? I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
- lxgr 4y ago
  The attack in this case would be somebody shoulder-surfing your PIN and grabbing your device. They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys. I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.
  - great_psy 4y ago
    Ah ok, yes the shoulder surfing is definitely a problem. Hard to mitigate somebody looking over your shoulder, this is the case with most password managers, but I understand why this is a more likely scenario.
    - lxgr 4y ago
      In a semi-safe situation (e.g. on busy public transit or in a crowded place with people behind me), I do sometimes unlock my password manager using Face ID to access a website, but I'd never enter my passphrase if the biometric unlock fails. If somebody watches me enter my passcode and then rips the device out of my hands and runs off with it (assuming the password manager is not open), they now have access to most of the content on my phone, but importantly not the parts protected by Face ID, which includes the password manager. If I had used Apple's password manager instead, they'd be able to recover all passwords (using the tactics described above or simply enrolling their own face in Face ID, which is possible using only the passcode).
      - balderdash 4y ago
        If you reset/create an alternate appearance for faceid does that force a manual login for the services that use it? Because your device passcode lets you change all the faceid stuff… too lazy to mess around with it myself
        lxgr 4y ago
        Apps can choose [1] to tie have keys to the current set of enrolled biometric credentials (i.e. faces or fingers), and at least my password manager does that, as far as I remember from some testing. Some apps don't, and some even react really poorly to a change of the biometric set (i.e. crashing at every Face ID use with no way to reset other than reinstalling), so I'm also not too keen on testing this on my main device. One thing that surprised me during my limited testing was that Apple apparently doesn't make use of this capability for storing the "encrypted notes" passphrase, which effectively also reduces the security of that to that of the device passcode. [1] https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/2937192-biometrycurrentset https://developer.apple.com/documentation/security/secaccess...
__david__ 4y ago
Incidentally this is the method my 6 year old nephew used to reset his mom’s Apple ID password so he could make in-app purchases. He figured it out on his own and then spent $3000 in a couple days. His mom had been very careful with her password but when he wanted a code on his iPad she thought it was harmless—she certainly never expected that he could get all the way to changing her password with nothing more than the lock code! Took her months to sort it out.