Why can't I access my keychain in iOS apps other than safari (or OSX apps, for that matter?). How can I access my passwords across the entire platform?
asked Jul 17, 2017 at 0:26
Add a comment
|
3 Answers
It's a design feature of the keychain system in macOS and iOS. Each keychain item is stored with a unique identifier that tells the system which application created it, and only that application is allowed to access it. There is also a concept of access groups, where a developer can allow access to a group of applications, for example so that Google only needs to store your credentials once to be used by all their apps.
In addition to globally locking and unlocking the entire keychain at appropriate times, the system also restricts which apps can access specific keychain items. By default, an app that creates an item, and only that app, can read it back or modify it. However, sometimes you want to share a secret among apps. How you do this depends on the situation.
...
From a high level perspective, Keychain Services uses an app’s code signature with its embedded entitlements to ensure that only an authorized app can access a particular keychain item. By default, only the app that created an item can access it in the future. But Keychain Services does more than simply check the identity of an app. Instead, it compares a keychain item’s access group, recorded as the kSecAttrAccessGroup attribute, with the list of access groups to which an app belongs. If one of the app’s access groups matches the keychain item’s group, access is granted. Similarly, Keychain Services allows an app to create keychain items with the kSecAttrAccessGroup attribute set to any of the app’s own access groups.
answered Jul 17, 2017 at 0:51
-
2hmm. so the other two answers basically told what I wanted to hear (this is going away soon), but you answered exactly why I can't in a detailed and informed manner. POINTS AWARDED!???!!! Commented Jul 18, 2017 at 3:00
Apple simply hasn't opened access to the Keychain to third-party apps. However that is changing in iOS 11. You'll be able to use your Keychain passwords across the system then.
You can access the full keychain by opening Keychain Access on Mac, which may be found in the Utilities folder. On iOS, you may access the keychain from settings under Safari within “Passwords”, however the API for the keychain has not been opened for developers.
Normally, you could access the relevant password if it’s is for an app distributed by the authority that also manages the web app, for example, Amazon, or any of the Google apps that pull keychain info with the permission of the user through the use of a safari window within the relating application to retrieve the API key for the app.
In iOS and macOS releases coming this fall, the feature will be built into the system, and apps will be able to access the keychain without using a window.
