3 ms·
If they are uploading the PW and not the hash then… they are uploading the passwords themselves, encrypted or not. And guess who has the decryption keys…?
by avazhi 2y ago
If they are uploading the PW and not the hash then… they are uploading the passwords themselves, encrypted or not.
And guess who has the decryption keys…?
- threeseed 2y agoOf course. Apple has to decrypt the passwords when it pre-fills the browser. And the decryption keys are stored on your devices in the Secure Enclave. Apple doesn’t have the keys on their servers.
- avazhi 2y agoEither way the passwords are being uploaded, which is the comment I was replying to.
- Veen 2y agoThe ciphertext is not the plaintext (obviously). So an encrypted password is not a password. An encrypted password is a string resulting from the application of an encryption algorithm and a key to a password. Uploading that string is not uploading the password. The fact that Apple's software can access the keys stored on the device to decrypt the password after you securely authenticate is neither here nor there.
- deleted 2y ago[deleted]
- Klonoar 2y agoYour response implied something that is outright incorrect, which is what is at issue here.
- deleted 2y ago[deleted]