Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently uploads your passwords and keeps them

lapcatsoftware.com

Post reply on HN
Print view View original

31–40 of 130 posts

Re: Apple silently uploads your passwords and keeps them

#31

Post by nicce »

hello0904 wrote: post #28
Refusing23 wrote: post #2

thats how cloud stored password managers work..

Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).

The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.

Re: Apple silently uploads your passwords and keeps them

#33

Post by hello0904 »

ethangk wrote: post #27
hello0904 wrote: post #26

Earlier quoted context omitted.

Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES. AES is not one way and in theory you can generate 2nd, 3rd, etc. master keys to decrypt. :)

That’s relevant when storing a users password to verify that they’ve entered the correct data, but password managers (which Keychain effectively is, I believe) need to be able to retrieve the original password

Frankly, you're confusing hashing algorithms, encryption and "IDs".

Authentication: "Prove you are you" (hash functions)

Secure Storage: "Keep this secret but let me get it back later" (encryption)

Identification: "Track who/what this is" (UUIDs/tokens)

Re: Apple silently uploads your passwords and keeps them

#34

Post by gruez »

leephillips wrote: post #22
Veen wrote: post #3

This may be annoying, but it’s uploading encrypted versions of passwords, not passwords themselves. Keychain is end-to-end encrypted so no one else can read them.

How do you know?

https://support.apple.com/en-us/102651

>Passwords and Keychain (6): End-to-end

Re: Apple silently uploads your passwords and keeps them

#35

Post by hello0904 »

nicce wrote: post #31
hello0904 wrote: post #28

Earlier quoted context omitted.

Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).

The whole OS is a blackbox. We trust that keyloggers are not everywhere. We need to trust completely or not at all. I think there is nothing between when the same vendor also supplying the underlying closed-source OS.

Agreed. But we are talking encryption and why there isn't open source algorithms for iCloud. I find it funny as when you submit iOS apps to the App Store they specifically require encryption standards and no "roll your own algos/cryptos" but at the same time all their crypto is a black box.

I'm a happy Apple user, love the OS...just saying.

Re: Apple silently uploads your passwords and keeps them

#36

Post by nicce »

coldtea wrote: post #5
Refusing23 wrote: post #2

thats how cloud stored password managers work..

They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!

> They offer no option to delete your passwords from the Cloud once there?

Does it matter tho. Like in general internet, once something is posted, it will not disappear with certainty. We can never be certain that there is a copy of the encrypted password on some log file when we have no visibility into that sytem. Since it is encrypted, it passes the regulation checks.

That is just a UI bug if passwords keep coming back in the cloud/you still see them. Unless there is a system in place that can transparently verify that indeed, the passwords are deleted, does it matter?

Re: Apple silently uploads your passwords and keeps them

#37

Post by stouset »

a2128 wrote: post #4
Refusing23 wrote: post #2

thats how cloud stored password managers work..

Normally you have to explicitly install and use a cloud stored password manager, automatically making the choice for you is a big no-no

If you don’t want it, don’t store your passwords in it?

Re: Apple silently uploads your passwords and keeps them

#38

Post by chrisBob »

hello0904 wrote: post #28
Refusing23 wrote: post #2

thats how cloud stored password managers work..

Well, the real problem is iCloud Keychain is essentially a "black box" system. Apple does use AES encryption in various parts of their security architecture, as documented in their security white papers. But we can't confirm the specific implementation details for iCloud Keychain. And you should also know... Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2).

> Best practices for password storage use one-way hash functions (like bcrypt, Argon2, or PBKDF2) rather than encryption algorithms like AES.

That is true if you are running a service that USES passwords. In that case you just need to confirm they match. That is not true if you are running a password manager where the user needs to be able to get their plain text password back out of the system.

Re: Apple silently uploads your passwords and keeps them

#39

Post by hu3 »

JimDabell wrote: post #23
create-username wrote: post #8

Earlier quoted context omitted.

Yes. SIP means Apple is the real sudo now. You can’t disable their special relationship on their computers

Yes you can. Here are the instructions to disable it: https://developer.apple.com/documentation/security/disabling...

Doesn't disabling SIP weaken the security?

Re: Apple silently uploads your passwords and keeps them

#40

Post by stouset »

hello0904 wrote: post #33
ethangk wrote: post #27

Earlier quoted context omitted.

That’s relevant when storing a users password to verify that they’ve entered the correct data, but password managers (which Keychain effectively is, I believe) need to be able to retrieve the original password

Frankly, you're confusing hashing algorithms, encryption and "IDs". Authentication: "Prove you are you" (hash functions) Secure Storage: "Keep this secret but let me get it back later" (encryption) Identification: "Track who/what this is" (UUIDs/tokens)

You are deeply confused as to how password managers work.

Password managers—all password managers—require stored passwords to be encrypted such that they can be decrypted. Otherwise they would have no possibly way to retrieve the stored secret for the sake of submitting it to the verifying party.

Best practice for verifiers is to use a one-way memory-hard password hash.

Keychain is a password manager.

Post reply on HN