4 ms·
> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as y
by js2 3y ago
> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.)
Passkeys are stored in the iCloud Keychain which is end-to-end encrypted with 256-bit AES. Passkeys cannot be read by Apple anywhere but on your own device.
- 5ersi 3y agoSo how does a new device join your iCloud and sync Keychain?
- dan-c-underwood 3y agohttps://support.apple.com/en-gb/guide/security/sec0a319b35f/web https://support.apple.com/en-gb/guide/security/sec0a319b35f/...
- starfallg 3y agoApple can install any software it wants up to the bootloader (iBoot) level on your iPhone via updates. So technically they can access your keys.
- j16sdiz 3y agoYes. So do any OS/TPM vendors. Unless you control/audit the whole stack (and forbid updates), you have to trust somebody.
- judge2020 3y agoYou can reset your device using an IPSW you got off the internet if you want to make sure Apple isn't shipping targeted firmware to your device specifically.
- js2 3y agoI anticipated this reply which is why I added the qualifier "anywhere but on your own device." Unless you intend to manufacture your own device from scratch, at some point you have to place your trust somewhere. See "reflections on trusting trust": https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/static/lectures/18-ReflectionsOnTrustingTrust/ReflectionsOnTrustingTrust.pdf https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/stati...
- notatoad 3y agoDoes icloud e2e still have a loophole where apple can re-key it for you whenever they want? That's how it used to work, and as long as that's how it works their e2e is just for show.