6 ms·

Apple silently uploads your passwords and keeps them

170 points by ingve 2y ago

Refusing23 2y ago
thats how cloud stored password managers work..
- a2128 2y ago
  Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no
  - stouset 2y ago
    If you don’t want it, don’t store your passwords in it?
    - SoftTalker 2y ago
      Yep. Disabling password storage is one of the first things I do when setting up a browser on a new computer.
  - acdha 2y ago
    A decade ago this was more true but all of the major browsers include a cloud password manager now, and this is very popular with normal people because it means a lost or failed device doesn’t mean they have to go through a bunch of password resets. The big question here is whether there’s a reproducible way that the opt-in changes. iCloud Keychain has robust end to end encryption but it still needs to inform the user.
- coldtea 2y ago
  They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!
  - gruez 2y ago
    >They offer no option to delete your passwords from the Cloud once there? Seems pretty trivial to download the icloud windows client (which has password manager support), and modify/delete the passwords there?
  - nicce 2y ago
    > They offer no option to delete your passwords from the Cloud once there? Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks. That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?
    - stouset 2y ago
      Your passwords are encrypted with keys stored only in the local on-device TPM. This is a pretty lame windmill to tilt at.
      - krageon 2y ago
        The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.
        Retric 2y ago
        Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything. They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.
        Sindisil 2y ago
- hello0904 2y ago
  Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).
  - nicce 2y ago
    The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.
    - hello0904 2y ago
      Agreed. But we are talking encryption and why there isn't open source algorithms for iCloud. I find it funny as when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" but at the same time all their crypto is a black box. I'm a happy Apple user, love the OS...just saying.
      - lapcat 2y ago
        > when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" This is not true.
  - chrisBob 2y ago
    > Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. That is true if you are running a service that USES passwords. In that case you just need to confirm they match. That is not true if you are running a password manager where the user needs to be able to get their plain text password back out of the system.
  - threeseed 2y ago
Veen 2y ago
This may be annoying, but it’s uploading encrypted versions of passwords, not passwords themselves. Keychain is end-to-end encrypted so no one else can read them.
- quyleanh 2y ago
  Are you sure Apple can’t read them too?
  - Veen 2y ago
    They say they can’t, but it’s impossible to be certain. Although, if you distrust Apple enough to think they might lie about it, you probably wouldn’t want to use any Apple device or services. They already have privileged access to the software and hardware.
    - create-username 2y ago
      Yes. SIP means Apple is the real sudo now. You can’t disable their special relationship on their computers
      - JimDabell 2y ago
        Yes you can. Here are the instructions to disable it: https://developer.apple.com/documentation/security/disabling-and-enabling-system-integrity-protection https://developer.apple.com/documentation/security/disabling...
        hu3 2y ago
        Doesn't disabling SIP weaken the security?
    - realusername 2y ago
      > They already have privileged access to the software and hardware. The fact that the phone manufacturer has a more privileged access than the owner of the phone is absolute insanity.
betimsl 2y ago
They probably encrypt the export with some kind of hash that is then securely transported to the new machine, decrypt it and import. Maybe someone can reverse engineer, attach a debugger and confirm, or analyze the traffic with a Transparent MITM Proxy on the new machine. Just grep for your password in the traffic captured, should be easy. And then write a blog post about that. Let's see what happens.
- axoltl 2y ago
  Or you could read their published security guide at https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... For the May 2024 version the section on iCloud Keychain is on page 158.
  - betimsl 2y ago
    I'm not in this field so I don't have time to read these documents. But I checked it out, and...from my understanding the document describes that they can't see your passwords because they do on device export+encrypt and new device decrypt+import. Is it like that in reality? Should be easy to confirm with a MITM Transparent Proxy, someone should try to find out. Just out of curiosity. It's exciting to find a company like Apple making a mistake, and they do make mistakes, but boy do they have quality software and it's getting better by the day. Just have a look at their SDK and interfaces: uniform and practical.
ellisv 2y ago
Apple refers to this as escrow and is a feature* of their secure iCloud Keychain recovery. [*] They consider it a feature; you may not. [1] https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/1/web/1 https://support.apple.com/guide/security/secure-icloud-keych... [2] https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for...
lapcat 2y ago
A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In general, the presence of my passwords in the cloud is an unwanted and unnecessary liability for me. I understand that for other people, cloud storage is a benefit, and I don't wish to deprive them of that choice. Nonethless, Apple deprived me of a choice in this case.
- tonyedgecombe 2y ago
  > Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.
  - lapcat 2y ago
    > Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.
    - falcolas 2y ago
      So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.
      - squidgedcricket 2y ago
        You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.
neilv 2y ago
All the trust-us data-grabby pushes by Apple products creeped me out, until I finally got rid of their products. For example, although I laboriously went through a ton of settings to make it less privacy-invading, I knew, for example, that I was still only one fumbled touch to a piece of glass away from Apple saying, "Oh, hey! I just grabbed all of your photos! Forever!" (Then Apple would say "Thanks!" in a sunny Californian way that normally is not every meaningful, but accidentally takes on meaning in the era of surveillance capitalism and AI training data.)
- rkagerer 2y ago
  What do you use now instead?
  - neilv 2y ago
    For smartphone, GrapheneOS. For tablet, I was using a PocketBook ereader (which works fine airgapped, and is friendly towards DRM-free ebooks, and doesn't need jailbreaking). For most purposes, Debian Stable on my laptop, and on my GPU server.
InMice 2y ago
The most obnxious aspect of owning an iphone for me. Apple turns icloud syncing on by default for everything, not just password management. Photos, browsing history etc. there should be an account setting that lets you turn this off completely no matter what device you sign into with your icloud account. Completely obnoxious, my icloud photos is a total mess of triple and double copies of photos going back decades i recently had no idea it was even syncing. All from signing in then having stop automatic syncing. I now only sign in when the device has fresh reset so i can immediately turn all the syncing off. This should be an account wide option that applies to any all current and future device sign ins.
- musicale 2y ago
  I hate default on for cloud sync. It should be opt-in.
  - musicale 2y ago
    To clarify, Apple is often good about requiring opt-in for a bunch of features, especially privacy-related features, and I appreciate that. Unfortunately there are some annoying corner cases, such as having to manually disable iCloud sync for photos (etc.), or the issue that OP ran into with having iCloud keychain re-enable itself after being turned off. It also used to be easier to actually turn off wi-fi and bluetooth without them reactivating automatically. I understand why they made it harder (to reduce complaints and support calls/appointments for AirDrop/AirPods/Apple watch/etc. not working due to user settings) but I would have preferred an alternative approach of making it simple and obvious how to fix any AirDrop or other issues while preserving the ability to easily turn off wi-fi.
rkagerer 2y ago
The blurring distinction between local and cloud has gotten so bad that not even a nerd can tell if their device is respecting the privacy border.
- atoav 2y ago
  It begins with the choice of operating system. Getting Windows/OSX to not phone home is one thing, ensuring it stays that way as the updates come in is another can of worms entirely.
- hhh 2y ago
  It’s pretty easy in macos, you turn off the features explicitly labeled as such in the nice icloud settings menu, or you never log into icloud in the first place
thunky 2y ago
Passwords should be going the way of the dodo anyway. They've been mostly reduced to single-use tokens thanks to password change policies. And they're no better than email verification codes, which can be used to change the password anyway.

170 points by ingve 2y ago

Refusing23 2y ago

thats how cloud stored password managers work..

a2128 2y ago
Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no
- stouset 2y ago
  If you don’t want it, don’t store your passwords in it?
  - SoftTalker 2y ago
    Yep. Disabling password storage is one of the first things I do when setting up a browser on a new computer.
- acdha 2y ago
  A decade ago this was more true but all of the major browsers include a cloud password manager now, and this is very popular with normal people because it means a lost or failed device doesn’t mean they have to go through a bunch of password resets. The big question here is whether there’s a reproducible way that the opt-in changes. iCloud Keychain has robust end to end encryption but it still needs to inform the user.
coldtea 2y ago
They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!
- gruez 2y ago
  >They offer no option to delete your passwords from the Cloud once there? Seems pretty trivial to download the icloud windows client (which has password manager support), and modify/delete the passwords there?
- nicce 2y ago
  > They offer no option to delete your passwords from the Cloud once there? Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks. That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?
  - stouset 2y ago
    Your passwords are encrypted with keys stored only in the local on-device TPM. This is a pretty lame windmill to tilt at.
    - krageon 2y ago
      The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.
      - Retric 2y ago
        Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything. They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.
        Sindisil 2y ago
hello0904 2y ago
Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).
- nicce 2y ago
  The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.
  - hello0904 2y ago
    Agreed. But we are talking encryption and why there isn't open source algorithms for iCloud. I find it funny as when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" but at the same time all their crypto is a black box. I'm a happy Apple user, love the OS...just saying.
    - lapcat 2y ago
      > when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" This is not true.
- chrisBob 2y ago
  > Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. That is true if you are running a service that USES passwords. In that case you just need to confirm they match. That is not true if you are running a password manager where the user needs to be able to get their plain text password back out of the system.
- threeseed 2y ago

Veen 2y ago

This may be annoying, but it’s uploading encrypted versions of passwords, not passwords themselves. Keychain is end-to-end encrypted so no one else can read them.

quyleanh 2y ago
Are you sure Apple can’t read them too?
- Veen 2y ago
  They say they can’t, but it’s impossible to be certain. Although, if you distrust Apple enough to think they might lie about it, you probably wouldn’t want to use any Apple device or services. They already have privileged access to the software and hardware.
  - create-username 2y ago
    Yes. SIP means Apple is the real sudo now. You can’t disable their special relationship on their computers
    - JimDabell 2y ago
      Yes you can. Here are the instructions to disable it: https://developer.apple.com/documentation/security/disabling-and-enabling-system-integrity-protection https://developer.apple.com/documentation/security/disabling...
      - hu3 2y ago
        Doesn't disabling SIP weaken the security?
  - realusername 2y ago
    > They already have privileged access to the software and hardware. The fact that the phone manufacturer has a more privileged access than the owner of the phone is absolute insanity.

betimsl 2y ago

They probably encrypt the export with some kind of hash that is then securely transported to the new machine, decrypt it and import. Maybe someone can reverse engineer, attach a debugger and confirm, or analyze the traffic with a Transparent MITM Proxy on the new machine. Just grep for your password in the traffic captured, should be easy. And then write a blog post about that. Let's see what happens.

axoltl 2y ago
Or you could read their published security guide at https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... For the May 2024 version the section on iCloud Keychain is on page 158.
- betimsl 2y ago
  I'm not in this field so I don't have time to read these documents. But I checked it out, and...from my understanding the document describes that they can't see your passwords because they do on device export+encrypt and new device decrypt+import. Is it like that in reality? Should be easy to confirm with a MITM Transparent Proxy, someone should try to find out. Just out of curiosity. It's exciting to find a company like Apple making a mistake, and they do make mistakes, but boy do they have quality software and it's getting better by the day. Just have a look at their SDK and interfaces: uniform and practical.

ellisv 2y ago

Apple refers to this as escrow and is a feature* of their secure iCloud Keychain recovery. [*] They consider it a feature; you may not. [1] https://support.apple.com/guide/security/secure-icloud-keychain-recovery-secdeb202947/1/web/1 https://support.apple.com/guide/security/secure-icloud-keych... [2] https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 https://support.apple.com/guide/security/escrow-security-for...

lapcat 2y ago

A crucial point to understand: unbeknownst to me, my passwords ended up on a device that I didn't specifically authorize to download them. The good news is that the device is owned by me and under my control. However, since it's just a test machine with no personal data—or so I believed—it's less protected than my other devices. For example, it has a weak login password, no Filevault, and no biometrics (Mac mini). In general, the presence of my passwords in the cloud is an unwanted and unnecessary liability for me. I understand that for other people, cloud storage is a benefit, and I don't wish to deprive them of that choice. Nonethless, Apple deprived me of a choice in this case.

tonyedgecombe 2y ago
> Apple deprived me of a choice in this case. Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac In general though having a weak password on a device logged in to iCloud is a bad idea.
- lapcat 2y ago
  > Settings -> Apple ID -> iCloud -> iCloud Passwords & Keychain -> Sync this Mac You clearly didn't even read the article. The whole point was that Apple silently toggled this on without my knowledge or consent.
  - falcolas 2y ago
    So do Chrome and Firefox. If you sign into them, they download your saved passwords which were uploaded to their clouds.
    - squidgedcricket 2y ago
      You don't have to sign into browsers. You don't even need an apple ID, I use a local account on my macbook. It's not the happy path though. We need a tech a company that prioritizes local-first designs.

neilv 2y ago

All the trust-us data-grabby pushes by Apple products creeped me out, until I finally got rid of their products. For example, although I laboriously went through a ton of settings to make it less privacy-invading, I knew, for example, that I was still only one fumbled touch to a piece of glass away from Apple saying, "Oh, hey! I just grabbed all of your photos! Forever!" (Then Apple would say "Thanks!" in a sunny Californian way that normally is not every meaningful, but accidentally takes on meaning in the era of surveillance capitalism and AI training data.)

rkagerer 2y ago
What do you use now instead?
- neilv 2y ago
  For smartphone, GrapheneOS. For tablet, I was using a PocketBook ereader (which works fine airgapped, and is friendly towards DRM-free ebooks, and doesn't need jailbreaking). For most purposes, Debian Stable on my laptop, and on my GPU server.

InMice 2y ago

The most obnxious aspect of owning an iphone for me. Apple turns icloud syncing on by default for everything, not just password management. Photos, browsing history etc. there should be an account setting that lets you turn this off completely no matter what device you sign into with your icloud account. Completely obnoxious, my icloud photos is a total mess of triple and double copies of photos going back decades i recently had no idea it was even syncing. All from signing in then having stop automatic syncing. I now only sign in when the device has fresh reset so i can immediately turn all the syncing off. This should be an account wide option that applies to any all current and future device sign ins.

musicale 2y ago
I hate default on for cloud sync. It should be opt-in.
- musicale 2y ago
  To clarify, Apple is often good about requiring opt-in for a bunch of features, especially privacy-related features, and I appreciate that. Unfortunately there are some annoying corner cases, such as having to manually disable iCloud sync for photos (etc.), or the issue that OP ran into with having iCloud keychain re-enable itself after being turned off. It also used to be easier to actually turn off wi-fi and bluetooth without them reactivating automatically. I understand why they made it harder (to reduce complaints and support calls/appointments for AirDrop/AirPods/Apple watch/etc. not working due to user settings) but I would have preferred an alternative approach of making it simple and obvious how to fix any AirDrop or other issues while preserving the ability to easily turn off wi-fi.

rkagerer 2y ago

The blurring distinction between local and cloud has gotten so bad that not even a nerd can tell if their device is respecting the privacy border.

atoav 2y ago
It begins with the choice of operating system. Getting Windows/OSX to not phone home is one thing, ensuring it stays that way as the updates come in is another can of worms entirely.
hhh 2y ago
It’s pretty easy in macos, you turn off the features explicitly labeled as such in the nice icloud settings menu, or you never log into icloud in the first place

thunky 2y ago

Passwords should be going the way of the dodo anyway. They've been mostly reduced to single-use tokens thanks to password change policies. And they're no better than email verification codes, which can be used to change the password anyway.