5 ms·

Tell HN: iCloud Password Sync turns on by itself on iOS 17

84 points by turbidimeter 3y ago

I just finally updated to iOS 17.2 from iOS 16. And now I remember why I usually hesitate with updates: After the update, iCloud Passwords and Keychain Sync turned on by itself. So all passwords and keychain info (I don't know what keychain info encompasses) is in the Cloud now. Apparently it's E2E encrypted, but in some closed source way which I didn't choose. This is a known issue apparently (https://9to5mac.com/2023/09/27/icloud-keychain-issues/) but not many people seemed to care. Also it's not clear if that data can be deleted from the Cloud at all (https://apple.stackexchange.com/questions/419116/are-there-any-solid-way-to-view-delete-online-icloud-keychain). The Apple Docs text has changed. Then, today iCloud Calendar Sync turned on by itself, too, which isn't E2E by default. I don't know what's next. I remember, in the past, iCloud Photo Sync turned on by itself too on some old version. Also "Live Voicemail" turned itself on. But that's not iCloud? I don't know. There were similar posts in the past (https://news.ycombinator.com/item?id=28285567). Apple, why do you keep doing this? I use iCloud for Find My iPhone and Wallet only, but it seems like you don't care and just enable other stuff as well, which I explicitly turned off before. I liked iOS because I thought Apple respects that kind of stuff, but now I'm not sure what phone to buy next. Perhaps this info is interesting for other folks here.

Meph504 3y ago
Any documentations to support this?
- salawat 3y ago
  Given the sensitivity and value of the info disclosure, lack of documentation doesn't necessarily refute experimentally reported results.
- turbidimeter 3y ago
  Happened to others: https://9to5mac.com/2023/09/27/icloud-keychain-issues/ https://9to5mac.com/2023/09/27/icloud-keychain-issues/ More info here: https://news.ycombinator.com/item?id=38648725 https://news.ycombinator.com/item?id=38648725 I resubmitted it again because the text content of the submission was missing.
lapcat 3y ago
This happened to me with iPadOS 17 beta 4 back in July. https://appdot.net/@lapcatsoftware/110776034855270972 https://appdot.net/@lapcatsoftware/110776034855270972 I've also been getting a "Verify Your Recovery Key" warning in Settings on both iPad and Mac ever since beta 4 of iPadOS 17 and Sonoma (and that continues to this day). Settings app was crashing too in beta 4. It was a really bad beta for iCloud stuff. Also worth noting: iOS and macOS re-enable Bluetooth after every update. https://lapcatsoftware.com/articles/bluetooth.html https://lapcatsoftware.com/articles/bluetooth.html
alphabettsy 3y ago
Software has bugs unfortunately.
- deleted 3y ago
  [deleted]
- mildmotive 3y ago
  This is a bad response to Apple stealing personal information from millions of people. OP is not alone when it comes to iCloud partially or completely enabling itself upon updates. The problem is that malware is perfectly legal as long as you have some EULA somewhere to cover it.
  - alphabettsy 3y ago
    The hyperbole seems unnecessary and imo is unproductive.
    - dackerlunghack 3y ago
      [dead]
    - mildmotive 3y ago
      You shouldn’t call it a hyperbole. Sometimes you have to point things out for what they are rather continue to pretend that it is normal.
  - bartvk 3y ago
    Personally I don't let Safari store anything, so there's nothing to sync, even if it was turned on without my consent.
thijsvandien 3y ago
Thanks for telling me about this. It's definitely not acceptable to appropriate such sensitive data without consent.
- grok25 3y ago
  It’s not being appropriated. It’s E2EE. It’s a bug, but nothing more.
  - turbidimeter 3y ago
    Doesn't feel like a bug to me. After disabling iCloud Passwords I see a big nag in the Passwords menu asking me to enable it again; I don't remember that there on iOS 16. And when it was enabled there was a nag for Passkeys or password family sharing or something like that. I guess they want people to use that now. Also I don't understand how you could screw these things up repeatedly for so many features. iMessage is another one that iOS loves to enable again. I just checked: it's enabled again. Turned it off. And the one with Bluetooth that lapcat mentioned. I don't believe these things to be bugs. But they really crossed the line for me with Passwords.
    - grok25 3y ago
      > Also I don't understand how you could screw these things up repeatedly for so many features. Seems like a generic bug in the settings system which is fairly complex. Pretty easy to see how something like that could happen.
      - robcohen 3y ago
        I agree. It’s easy to see how a user hostile setting would go unchecked by a large corporate company that doesn’t benefit from protecting the privacy of its users.
        grok25 3y ago
        That’s a weird conspiracy theory. How does anyone figure Apple benefits from this. How is the setting even ‘user hostile’?
mynameisnoone 3y ago
Thank for the warning. I use Bitwarden exclusively. It didn't happen on iPhone 13 Pro 17.1.2 -> 17.2. Currently upgrading iPad Pro 4th gen as it took until today to get iPadOS 17.2.
joeframbach 3y ago
This sounds like a violation of the CFAA per unauthorized use of computer resources. Think Apple would be held liable for it?
- grok25 3y ago
  What computer resources are being used without authorization?
  - hedora 3y ago
    They gave Apple authorization to access their phone (the phone is not Apple property) in order to copy certain things into the cloud. They uploaded new software and downloaded data they were not authorized to download without getting permission first. I'm sure there is some cover your ass clause in the EULA that tries to protect them when they (accidentally or on purpose) violate the CFAA, but, in this case, they pretty clearly did things that exceeded their authorization. The relevant part of the CFAA is a.1 (I removed the bits that are irrelevant): > (a) Whoever— > (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained ... restricted data, as defined in ... causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it ... https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
    - gruez 3y ago
      That definition quickly becomes absurd. If I run "cat a.txt b.txt" but only give it authorization to read a.txt, does that mean Richard Stallman (or whoever wrote the program) is breaking the law? You might say consent is implied in that case but: 1. I thought implied consent was out of fashion these days 2. What if it's something like an IDE that reads the surrounding directories? VS code does that and I certainly didn't know that feature even existed before I first opened it, so how could have given authorization? Is Microsoft in breach of the CFAA?
perryizgr8 3y ago
I recently got an OS update on my Macbook Pro and after reboot it forced me to change my password because "you can't have the same password on your laptop as in your icloud account". It's amazing how much apple feels the device I bought actually belongs to them :/
blissfulresup 3y ago
Thank you for taking the time to post, wouldn’t have caught it otherwise
nixgeek 3y ago
Do you have Advanced Data Protection enabled on your Apple ID? Configuration Profiles can also be a good way to more strongly force certain settings on devices, including that functionality be disabled. They’re how MDM works in most corporate settings.
rkagerer 3y ago
Although I'm not particularly happier over here on Android, this makes me glad I switched away from the Apple ecosystem a decade ago. It's a shame as I do occasionally get hardware envy. Thanks for sharing the story.
pndy 3y ago
For me it's the Medical ID data that turns itself on in iCloud storage devices backup details. I've noticed this last night, turned it off and it's morning here (Europe) and that switcher is set to on again. I have Health app uninstalled and set to off in Apps using iCloud page.
WentFullRetard 3y ago
[dead]
tholdem 3y ago
Imagine being in China and finding this out after an update. I used an iPhone a few years ago and when setting it up, I made sure to turn off all iCloud stuff. When it was time to get a new phone, I noticed all my pictures were in iCloud. I also did not like how hard it was to try and keep Bluetooth and Wifi turned off. Regularly it would nag me to connect to an open Wifi when I was sure I switched Wifi off completely. Turns out iOS re-enables both Wifi and Bluetooth after OS updates and you can't completely switch them off from the quick settings. If users privacy was so important, wouldn't you want to make sure all that stuff would not happen? Also, it's good practice to reboot your phone one in a while, so why isn't there a reboot option in iOS?
- chrisandchris 3y ago
  > Also, it's good practice to reboot your phone one in a while, so why isn't there a reboot option in iOS? Out of curiosity, what is the advantage of rebooting your phone? I disn't do it for a couple of months and I don't see what gets "better". Besides, turning it off and on again will reboot it too. Just slighty more inconvienent :)
  - tholdem 3y ago
    Modern smartphone security relies on verified boot which cryptographically verifies various components in the boot process all the way to the kernel and beyond to make sure they have not been tampered with. This not only protects against physical attack vectors, but also remote as it can detect and prevent malicious modifications to the firmware and OS. For example, this makes malware persistence much more difficult, as verified boot checks for integrity at every boot and reverses any unsigned changes. Persistence on iOS and Android is very difficult. As an example, at least on iOS, threat actors have sometimes failed to achieve persistence, so they hijack the shutdown process and simply fake shutdown by animating the shutdown flow. The user thinks they've shut down the phone, but in reality the device was never shut down and never went through the verified boot process. However, since Steve Jobs decided iOS never needs a manual reboot, gaining persistence may not even be necessary, because people don't reboot their iPhones.

84 points by turbidimeter 3y ago

Meph504 3y ago

Any documentations to support this?

salawat 3y ago
Given the sensitivity and value of the info disclosure, lack of documentation doesn't necessarily refute experimentally reported results.
turbidimeter 3y ago
Happened to others: https://9to5mac.com/2023/09/27/icloud-keychain-issues/ https://9to5mac.com/2023/09/27/icloud-keychain-issues/ More info here: https://news.ycombinator.com/item?id=38648725 https://news.ycombinator.com/item?id=38648725 I resubmitted it again because the text content of the submission was missing.

lapcat 3y ago

This happened to me with iPadOS 17 beta 4 back in July. https://appdot.net/@lapcatsoftware/110776034855270972 https://appdot.net/@lapcatsoftware/110776034855270972 I've also been getting a "Verify Your Recovery Key" warning in Settings on both iPad and Mac ever since beta 4 of iPadOS 17 and Sonoma (and that continues to this day). Settings app was crashing too in beta 4. It was a really bad beta for iCloud stuff. Also worth noting: iOS and macOS re-enable Bluetooth after every update. https://lapcatsoftware.com/articles/bluetooth.html https://lapcatsoftware.com/articles/bluetooth.html

alphabettsy 3y ago

Software has bugs unfortunately.

deleted 3y ago
[deleted]
mildmotive 3y ago
This is a bad response to Apple stealing personal information from millions of people. OP is not alone when it comes to iCloud partially or completely enabling itself upon updates. The problem is that malware is perfectly legal as long as you have some EULA somewhere to cover it.
- alphabettsy 3y ago
  The hyperbole seems unnecessary and imo is unproductive.
  - dackerlunghack 3y ago
    [dead]
  - mildmotive 3y ago
    You shouldn’t call it a hyperbole. Sometimes you have to point things out for what they are rather continue to pretend that it is normal.
- bartvk 3y ago
  Personally I don't let Safari store anything, so there's nothing to sync, even if it was turned on without my consent.

thijsvandien 3y ago

Thanks for telling me about this. It's definitely not acceptable to appropriate such sensitive data without consent.

grok25 3y ago
It’s not being appropriated. It’s E2EE. It’s a bug, but nothing more.
- turbidimeter 3y ago
  Doesn't feel like a bug to me. After disabling iCloud Passwords I see a big nag in the Passwords menu asking me to enable it again; I don't remember that there on iOS 16. And when it was enabled there was a nag for Passkeys or password family sharing or something like that. I guess they want people to use that now. Also I don't understand how you could screw these things up repeatedly for so many features. iMessage is another one that iOS loves to enable again. I just checked: it's enabled again. Turned it off. And the one with Bluetooth that lapcat mentioned. I don't believe these things to be bugs. But they really crossed the line for me with Passwords.
  - grok25 3y ago
    > Also I don't understand how you could screw these things up repeatedly for so many features. Seems like a generic bug in the settings system which is fairly complex. Pretty easy to see how something like that could happen.
    - robcohen 3y ago
      I agree. It’s easy to see how a user hostile setting would go unchecked by a large corporate company that doesn’t benefit from protecting the privacy of its users.
      - grok25 3y ago
        That’s a weird conspiracy theory. How does anyone figure Apple benefits from this. How is the setting even ‘user hostile’?

mynameisnoone 3y ago

Thank for the warning. I use Bitwarden exclusively. It didn't happen on iPhone 13 Pro 17.1.2 -> 17.2. Currently upgrading iPad Pro 4th gen as it took until today to get iPadOS 17.2.

joeframbach 3y ago

This sounds like a violation of the CFAA per unauthorized use of computer resources. Think Apple would be held liable for it?

grok25 3y ago
What computer resources are being used without authorization?
- hedora 3y ago
  They gave Apple authorization to access their phone (the phone is not Apple property) in order to copy certain things into the cloud. They uploaded new software and downloaded data they were not authorized to download without getting permission first. I'm sure there is some cover your ass clause in the EULA that tries to protect them when they (accidentally or on purpose) violate the CFAA, but, in this case, they pretty clearly did things that exceeded their authorization. The relevant part of the CFAA is a.1 (I removed the bits that are irrelevant): > (a) Whoever— > (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained ... restricted data, as defined in ... causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it ... https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
  - gruez 3y ago
    That definition quickly becomes absurd. If I run "cat a.txt b.txt" but only give it authorization to read a.txt, does that mean Richard Stallman (or whoever wrote the program) is breaking the law? You might say consent is implied in that case but: 1. I thought implied consent was out of fashion these days 2. What if it's something like an IDE that reads the surrounding directories? VS code does that and I certainly didn't know that feature even existed before I first opened it, so how could have given authorization? Is Microsoft in breach of the CFAA?

perryizgr8 3y ago

I recently got an OS update on my Macbook Pro and after reboot it forced me to change my password because "you can't have the same password on your laptop as in your icloud account". It's amazing how much apple feels the device I bought actually belongs to them :/

blissfulresup 3y ago

Thank you for taking the time to post, wouldn’t have caught it otherwise

nixgeek 3y ago

Do you have Advanced Data Protection enabled on your Apple ID? Configuration Profiles can also be a good way to more strongly force certain settings on devices, including that functionality be disabled. They’re how MDM works in most corporate settings.

rkagerer 3y ago

Although I'm not particularly happier over here on Android, this makes me glad I switched away from the Apple ecosystem a decade ago. It's a shame as I do occasionally get hardware envy. Thanks for sharing the story.

pndy 3y ago

For me it's the Medical ID data that turns itself on in iCloud storage devices backup details. I've noticed this last night, turned it off and it's morning here (Europe) and that switcher is set to on again. I have Health app uninstalled and set to off in Apps using iCloud page.

WentFullRetard 3y ago

[dead]

tholdem 3y ago

Imagine being in China and finding this out after an update. I used an iPhone a few years ago and when setting it up, I made sure to turn off all iCloud stuff. When it was time to get a new phone, I noticed all my pictures were in iCloud. I also did not like how hard it was to try and keep Bluetooth and Wifi turned off. Regularly it would nag me to connect to an open Wifi when I was sure I switched Wifi off completely. Turns out iOS re-enables both Wifi and Bluetooth after OS updates and you can't completely switch them off from the quick settings. If users privacy was so important, wouldn't you want to make sure all that stuff would not happen? Also, it's good practice to reboot your phone one in a while, so why isn't there a reboot option in iOS?

chrisandchris 3y ago
> Also, it's good practice to reboot your phone one in a while, so why isn't there a reboot option in iOS? Out of curiosity, what is the advantage of rebooting your phone? I disn't do it for a couple of months and I don't see what gets "better". Besides, turning it off and on again will reboot it too. Just slighty more inconvienent :)
- tholdem 3y ago
  Modern smartphone security relies on verified boot which cryptographically verifies various components in the boot process all the way to the kernel and beyond to make sure they have not been tampered with. This not only protects against physical attack vectors, but also remote as it can detect and prevent malicious modifications to the firmware and OS. For example, this makes malware persistence much more difficult, as verified boot checks for integrity at every boot and reverses any unsigned changes. Persistence on iOS and Android is very difficult. As an example, at least on iOS, threat actors have sometimes failed to achieve persistence, so they hijack the shutdown process and simply fake shutdown by animating the shutdown flow. The user thinks they've shut down the phone, but in reality the device was never shut down and never went through the verified boot process. However, since Steve Jobs decided iOS never needs a manual reboot, gaining persistence may not even be necessary, because people don't reboot their iPhones.