Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple silently uploads your passwords and keeps them

lapcatsoftware.com

Post reply on HN
Print view View original

51–60 of 130 posts

Re: Apple silently uploads your passwords and keeps them

#51

Post by Retric »

krageon wrote: post #46
stouset wrote: post #42

Earlier quoted context omitted.

Your passwords are encrypted with keys stored only in the local on-device TPM. This is a pretty lame windmill to tilt at.

The only person guaranteeing this is the case and will stay the case is the person keeping your passwords. That seems to me to be a pretty wild thing to have faith in.

Companies aren’t people. Compare the benefits to a multi trillion dollar company to maintain security vs the minimal benefits from using your passwords for anything.

They really want to avoid the risk from anyone inside the company having access to your passwords and then doing anything with them.

Re: Apple silently uploads your passwords and keeps them

#52

Post by ziddoap »

hello0904 wrote: post #33
ethangk wrote: post #27

Earlier quoted context omitted.

That’s relevant when storing a users password to verify that they’ve entered the correct data, but password managers (which Keychain effectively is, I believe) need to be able to retrieve the original password

Frankly, you're confusing hashing algorithms, encryption and "IDs". Authentication: "Prove you are you" (hash functions) Secure Storage: "Keep this secret but let me get it back later" (encryption) Identification: "Track who/what this is" (UUIDs/tokens)

>Secure Storage: "Keep this secret but let me get it back later" (encryption)

This is what keychain does. You retrieve the passwords later.

So, no. It is not a one-way hash function as you stated.

Re: Apple silently uploads your passwords and keeps them

#53

Post by ellisv »

Apple refers to this as escrow and is a feature* of their secure iCloud Keychain recovery.

[*] They consider it a feature; you may not.

[1] https://support.apple.com/guide/security/secure-icloud-keych...

[2] https://support.apple.com/guide/security/escrow-security-for...

Re: Apple silently uploads your passwords and keeps them

#54

Post by acdha »

leephillips wrote: post #41
gruez wrote: post #34

Earlier quoted context omitted.

https://support.apple.com/en-us/102651 >Passwords and Keychain (6): End-to-end

I understand that Apple claims that this is the case. But given their history of incompetence in the past, that claim affords me little confidence that their closed source software does not contain critical bugs that might lead to recording or exposing the users’ plaintext passwords.

“History of incompetence” really needs some citations, especially for the belief that open source tools are better - they had Gotofail but OpenSSL had Heartbleed, etc. One of the better questions to ask is not how the source code is managed but how it’s audited: there’s a long history of problems in both open and closed software but well audited codebases tend to have them patched before exploits are publicly available.

Re: Apple silently uploads your passwords and keeps them

#55

Post by lapcat »

threeseed wrote: post #44
coldtea wrote: post #5

Earlier quoted context omitted.

They silently enable the option to store in the Cloud on OS update? They offer no option to delete your passwords from the Cloud once there? If that's indeed how they all/always work, we shouldn't just Stockholm-syndrome accept it!

You just open Keychain/Passwords and delete the passwords. Has been this way for at least a decade.

> You just open Keychain/Passwords and delete the passwords.

This also deletes the local copy of the passwords.

Re: Apple silently uploads your passwords and keeps them

#56

Post by threeseed »

avazhi wrote: post #13
Veen wrote: post #3

This may be annoying, but it’s uploading encrypted versions of passwords, not passwords themselves. Keychain is end-to-end encrypted so no one else can read them.

If they are uploading the PW and not the hash then… they are uploading the passwords themselves, encrypted or not. And guess who has the decryption keys…?

Of course. Apple has to decrypt the passwords when it pre-fills the browser.

And the decryption keys are stored on your devices in the Secure Enclave. Apple doesn’t have the keys on their servers.

Re: Apple silently uploads your passwords and keeps them

#57

Post by threeseed »

lapcat wrote: post #55
threeseed wrote: post #44

Earlier quoted context omitted.

You just open Keychain/Passwords and delete the passwords. Has been this way for at least a decade.

> You just open Keychain/Passwords and delete the passwords. This also deletes the local copy of the passwords.

There is a separate iCloud Keychain so you can just copy to your local one.

Or use the Export All Passwords feature in the Passwords app.

Re: Apple silently uploads your passwords and keeps them

#58

Post by avazhi »

threeseed wrote: post #56
avazhi wrote: post #13

Earlier quoted context omitted.

If they are uploading the PW and not the hash then… they are uploading the passwords themselves, encrypted or not. And guess who has the decryption keys…?

Of course. Apple has to decrypt the passwords when it pre-fills the browser. And the decryption keys are stored on your devices in the Secure Enclave. Apple doesn’t have the keys on their servers.

Either way the passwords are being uploaded, which is the comment I was replying to.

Re: Apple silently uploads your passwords and keeps them

#59

Post by threeseed »

blitzar wrote: post #18
quyleanh wrote: post #6

Earlier quoted context omitted.

Are you sure Apple can’t read them too?

Are you sure AES 256-bit hasn't been broken?

Note that you have to break 3 independent levels of AES encryption.

One for password key column, one for value column and one for the password file.

Re: Apple silently uploads your passwords and keeps them

#60

Post by netdevnet »

VMtest wrote: post #45
netdevnet wrote: post #32

Earlier quoted context omitted.

They own the OS. They don't need to break it to access your passwords

I am not sure if you are ignorant or what, but GP obviously means someone else other than Apple

It means Apple. See: "Are you sure Apple can’t read them too?".

Next time you insult someone, better use your cognition powers to avoid looking like that which you call others

Post reply on HN