3 ms·

Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychai

by dvzk 3y ago

Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychain extraction tools that exist. I don't know why you would want to though. Since (1) passkeys will rarely be a required nonreissuable credential, and (2) losing access to iCloud Keychain is extremely improbable. For many users, showing ID to a phone store clerk is sufficient for iCloud recovery. For others, it's using their laptop, a recovery key, or a recovery contact.

philsnow 3y ago
> showing ID to a phone store clerk is sufficient for iCloud recovery Can you walk me through how that works? I don't know how Verizon, for instance, could get me that access. Or did you mean at an Apple store or something?
- dvzk 3y ago
  https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for... https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/1/web/1 https://support.apple.com/guide/security/secure-icloud-keych... https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305 Basically: For some subset of iCloud Keychain users, SMS is used in combination with the lost device's passcode (or a user-chosen password) to recover the keychain. Since the device is lost, you re-issue the phone number with a carrier. I think 2FA or ADP may require another device or a recovery key, but my memory is hazy on this.
donmcronald 3y ago
> Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychain extraction tools that exist. Really? That sounds awful. So now everything is passwordless and tied to a single database that can be stolen? I thought the whole point of passkey was to tie the login to a TPM, Secure Enclave, HSM, etc. managed key because that means the private key is in hardened, tamper proof storage that simply signs challenges.
- dvzk 3y ago
  Sorry, that's only speculation, since I haven't had more time to analyze the database. If you read Apple's passkey security document, it claims that passkeys are distributed identically across devices. And that you can recover the passkeys even in the event that all associated devices are lost. It's also possible to share passkeys at any time. passkeys.com: > When a user sets up a passkey, a key is generated and synchronized to the cloud. When the user connects from another device in the same ecosystem, it will use the same key. WebAuthn supports verified attestations for hardware-backed authenticators. Passkeys seem to be designed for normal consumers, who worry about losing authenticator devices.

by dvzk 3y ago

philsnow 3y ago

> showing ID to a phone store clerk is sufficient for iCloud recovery Can you walk me through how that works? I don't know how Verizon, for instance, could get me that access. Or did you mean at an Apple store or something?

dvzk 3y ago
https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for... https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/1/web/1 https://support.apple.com/guide/security/secure-icloud-keych... https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305 Basically: For some subset of iCloud Keychain users, SMS is used in combination with the lost device's passcode (or a user-chosen password) to recover the keychain. Since the device is lost, you re-issue the phone number with a carrier. I think 2FA or ADP may require another device or a recovery key, but my memory is hazy on this.

donmcronald 3y ago

> Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychain extraction tools that exist. Really? That sounds awful. So now everything is passwordless and tied to a single database that can be stolen? I thought the whole point of passkey was to tie the login to a TPM, Secure Enclave, HSM, etc. managed key because that means the private key is in hardened, tamper proof storage that simply signs challenges.

dvzk 3y ago
Sorry, that's only speculation, since I haven't had more time to analyze the database. If you read Apple's passkey security document, it claims that passkeys are distributed identically across devices. And that you can recover the passkeys even in the event that all associated devices are lost. It's also possible to share passkeys at any time. passkeys.com: > When a user sets up a passkey, a key is generated and synchronized to the cloud. When the user connects from another device in the same ecosystem, it will use the same key. WebAuthn supports verified attestations for hardware-backed authenticators. Passkeys seem to be designed for normal consumers, who worry about losing authenticator devices.