Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
lapcatsoftware.com
Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
1–10 of 69 posts
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#2This isn't the first time, nor will it be the last: the only reason I'm actually using iCloud Keychain is because, despite always turning it off and feeling like I needed to keep doing it over and over again every time I got a new device, one day I was in a discussion with someone about it and I went to show them how I turn off most of the iCloud features, and I discovered I had actually failed and now had already been using iCloud Keychain and so all my passwords were already in it.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#3Isn't the workaround here to back up your keychain file, remove your passwords from the keychain, update to Sonoma, disable iCloud keychain, then import the backup? Not a trivial process, but should be easier than the author's attempted workaround of disabling SIP and installing while offline.
Long term I suspect the actual answer will be that if you don't want to use iCloud Keychain then you just can't use the keychain at all, which is a shame as it once was one of the good parts of macOS.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#4Isn't the workaround here to back up your keychain file, remove your passwords from the keychain, update to Sonoma, disable iCloud keychain, then import the backup? Not a trivial process, but should be easier than the author's attempted workaround of disabling SIP and installing while offline. Long term I suspect the actual answer will be that if you don't want to use iCloud Keychain then you just can't use the keych…
> should be easier than the author's attempted workaround of disabling SIP and installing while offline
Disabling SIP wasn't an issue, because I had already done it to eliminate slow app launches: https://lapcatsoftware.com/articles/2024/2/3.html
On my second attempt, I managed to update without an internet connection. See the new addendum to the article.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#5i understand and agree that this should at the very least have an opt-in dialog box.
that said, apple did add the option for end-to-end encrypted “advanced data protection” for the majority of icloud data a year or so ago.
perhaps they also enabled it by default in sonoma?
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#6i understand and agree that this should at the very least have an opt-in dialog box. that said, apple did add the option for end-to-end encrypted “advanced data protection” for the majority of icloud data a year or so ago. perhaps they also enabled it by default in sonoma? https://support.apple.com/en-us/108756
> perhaps they also enabled it by default in sonoma?
No, they didn't.
Anyway, iCloud Keychain has always been end to end encrypted.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#7This isn't the first time, nor will it be the last: the only reason I'm actually using iCloud Keychain is because, despite always turning it off and feeling like I needed to keep doing it over and over again every time I got a new device, one day I was in a discussion with someone about it and I went to show them how I turn off most of the iCloud features, and I discovered I had actually failed and now had already be…
I had the exact same experience with iCloud Drive (or whatever it is/was called) years ago. I kept turning it off and never agreed to use it and one day discovered it was on anyway and a bunch of my stuff was already in the cloud.
Pretty egregious behaviour.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#8i understand and agree that this should at the very least have an opt-in dialog box. that said, apple did add the option for end-to-end encrypted “advanced data protection” for the majority of icloud data a year or so ago. perhaps they also enabled it by default in sonoma? https://support.apple.com/en-us/108756
Even with so-called standard data protection, iCloud Keychain passwords are always end-to-end encrypted, and Apple cannot decrypt them.
"For additional privacy and security, 15 data categories — including Health and passwords in iCloud Keychain — are end-to-end encrypted. Apple doesn't have the encryption keys for these categories, and we can't help you recover this data if you lose access to your account."
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#9Gah, I didn’t realize that iCloud Keychain was enabled automatically on ios17. I checked and it’s been on for months. Why would they do this?
I remember when Microsoft uploaded people’s personal wifi creds in Windows 10. It’s all highly suspect.
Stop it. This over sharing by default will doom us all.
Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain
#10Gah, I didn’t realize that iCloud Keychain was enabled automatically on ios17. I checked and it’s been on for months. Why would they do this? I remember when Microsoft uploaded people’s personal wifi creds in Windows 10. It’s all highly suspect. Stop it. This over sharing by default will doom us all.
Actually, I figured it out, when an app I wrote, that uses the keychain, started allowing me to log into the app, using Sign in with Apple (which has some stuff that is only available when the login is set up), on devices that were not the ones that I set up.
In my case, I liked that, and so will my users.
But I do think that it could be problematic, if this means that authorities could now get ahold of your keychain, when having it restricted to a single device, avoids that.