Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

lapcatsoftware.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#21

Post by CharlesW »

Teever wrote: post #19
CharlesW wrote: post #8

Earlier quoted context omitted.

Even with so-called standard data protection, iCloud Keychain passwords are always end-to-end encrypted, and Apple cannot decrypt them. "For additional privacy and security, 15 data categories — including Health and passwords in iCloud Keychain — are end-to-end encrypted. Apple doesn't have the encryption keys for these categories, and we can't help you recover this data if you lose access to your account." https://s…

> Apple cannot decrypt them. How do you know this?

I provided both a citation and the relevant quote from it.

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#22

Post by shuckles »

38 wrote: post #20
LeoPanthera wrote: post #14

Earlier quoted context omitted.

That is not related. Mac computers store the last successful wifi credentials in in the EFI, and use them to give macOS Recovery internet access.

That is fucking terrifying.

Your laptop storing a Wifi credential locally is terrifying?

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#23

Post by Teever »

CharlesW wrote: post #21
Teever wrote: post #19

Earlier quoted context omitted.

> Apple cannot decrypt them. How do you know this?

I provided both a citation and the relevant quote from it.

If it did turn out that Apple was actually able to do what they claim they can't, how would you explain the source that you linked to?

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#24

Post by CharlesW »

Teever wrote: post #23
CharlesW wrote: post #21

Earlier quoted context omitted.

I provided both a citation and the relevant quote from it.

If it did turn out that Apple was actually able to do what they claim they can't, how would you explain the source that you linked to?

> If it did turn out that Apple was actually able to do what they claim they can't…

My friend, I'm afraid I have no idea what you mean. What do you believe Apple claims they can't do that conflicts with this? (If your answer is "end-to-end encryption", Apple has supported this for at least a decade.)

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#26

Post by sunshowers »

lapcat wrote: post #4
plorkyeran wrote: post #3

Isn't the workaround here to back up your keychain file, remove your passwords from the keychain, update to Sonoma, disable iCloud keychain, then import the backup? Not a trivial process, but should be easier than the author's attempted workaround of disabling SIP and installing while offline. Long term I suspect the actual answer will be that if you don't want to use iCloud Keychain then you just can't use the keych…

> should be easier than the author's attempted workaround of disabling SIP and installing while offline Disabling SIP wasn't an issue, because I had already done it to eliminate slow app launches: https://lapcatsoftware.com/articles/2024/2/3.html On my second attempt, I managed to update without an internet connection. See the new addendum to the article.

> Perhaps disabling System Integrity Protection disables the malware scan too? I haven't checked this, but it's not really viable for me as a Mac software developer, because I need to test the same runtime environment as my users, otherwise I could write code that works for me but not for my users.

I'd be a bit careful here by the way. Disabling SIP results in other weird differences too, that may cause programs to run for you but not most of your users.

For example, LD_ and DYLD_ environment variables are no longer sanitized [1] for system processes.

Fun fact: the GitHub Actions Mac environment also disables SIP. So it might run for you and in CI, but not for your users.

[1] https://briandfoy.github.io/macos-s-system-integrity-protect...

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#27

Post by vbezhenar »

x3n0ph3n3 wrote: post #17
LeoPanthera wrote: post #11

Presumably, only if you already have an iCloud account, and are signed in?

Pretty sure that's the case. I don't know why anyone trusts iCloud.

Is it possible to use macOS and iOS without iCloud? I never tried.

Re: Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

#29

Post by eep_social »

vbezhenar wrote: post #27
x3n0ph3n3 wrote: post #17

Earlier quoted context omitted.

Pretty sure that's the case. I don't know why anyone trusts iCloud.

Is it possible to use macOS and iOS without iCloud? I never tried.

macOS yes, though it breaks a lot of the “just works” style integration. On iOS I don’t know how you’d install anything beyond the apps included out of the box so it would be very limited.
Post reply on HN