6

I'm a little worried about a process I see in Activity Monitor called 'EscrowSecurityAlert'

Descriptions provided other forums ranges from it being a sign of malware:

The threat to your Mac is CleanMyMac. Delete it.

through to it being harmless:

This should be perfectly fine as something

and descriptions I don't understand (I can't think of anything I use that requires 'data escrow'):

Escrow is a data security measure in which acryptographic key is entrusted to a third party (i.e., kept in escrow). Under normal circumstances, the key is not released to someone other than the sender or receiver without proper authorization. Key escrow systems can be considered a security risk at the user puts access to information into the hands of the escrow agent holding the cryptographic key; however, key escrow systems are used to ensure that there is a backup of the cryptographic key in case the parties with access to key lose the data through a disaster or malicious intent.

Question

Regarding the 'EscrowSecurityAlert' process - is this something that ships with macOS or have I installed it myself somehow?

Improve this question
5
  • Why would you be worried about a process running on the Mac? (Or more to the point - what information would you trust to say it’s not some malware running disguised as a legit system service?)
    – bmike ♦
    Commented May 3, 2021 at 13:45
  • 1
    @bmike well, if EscrowSecurityAlert comes with macOS, I'll worry a lot less than if I've installed something dodgy that needs investigating. I guess that's the very first question: does EscrowSecurityAlert come with macOS, or have I obtained it elsewhere. I don't know how to answer that without viewing the macOS source code or asking someone who knows macOS well enough to answer
    – stevec
    Commented May 3, 2021 at 13:48
  • @bmike thanks for the suggestion, done.
    – stevec
    Commented May 3, 2021 at 14:49
  • 4
    Your first reference is a mis-reading of the linked post. It was alluded that CleanMyMac itself was the "virus". This at the time was likely due to its being confused with another Mac "fixit" tool of the time [the name of which I have now forgotten] which was not quite malware, but not as useful as it would like to have you think. There was a general mistrust of any new toolkit for quite a while after this.
    – Tetsujin
    Commented May 3, 2021 at 15:53
  • The first link clearly doesn't say anything aboutEscrowSecurityAlert being bad; it only says "[things like this] are parts of the operating system that CleanMyMac thinks in its infinite stupidity are a problem.". As @tetsujin said, you misread it.
    – smci
    Commented Jul 13, 2022 at 21:09

2 Answers 2

Reset to default
8

Yes, it's part of macOS & has been since perhaps Mavericks.

Wikipedia lists it in List of macOS components but provides no description -

The iPhone Wiki gives a brief description

This application works with the iCloud Keychain servers. It manages the password uploads and anything that keychain tools does.

By definition an escrow service is one who acts as a middle-man in a complex or expensive process. It is often used when buying/selling a house. The escrow company holds both the deeds and the money until all parties have completed the legal requirements to transfer the property, preventing either one from 'running off with the money'.

In computing terms it is an arbitrator between two not-necessarily-yet-trusted 'clients'. It prevents any data from one leaking to the other until full trust is established. In effect, it doesn't let anything 'run off with the money'.
This is, in effect, a less mind-numbing version of your last link & quote.

Improve this answer
2

/System/Library/CoreServices/EscrowSecurityAlert.app is part of macOS and is involved in the configuration and maintenance of the iCloud Keychain security code.

For example, prompts for entering the code to configure a new device with access to the Keychain.

If you've ever seen one of these messages, it's a dialog from this app:

  • ESCROW_ELE_ALERT_MESSAGE

    Create New iCloud Security Code
    A new security code must be created because of a change to iCloud Keychain servers.

    (Apple wrote a support article about this message: If you're asked to create a new iCloud security code)

  • RECORD_BURNED_ALERT_MESSAGE

    Update Your iCloud Security Code
    Your security code was incorrectly entered too many times on one of your other devices and can no longer be used.

  • RESET_CONFIRMATION_MESSAGE

    Reset and Turn Off iCloud Keychain?
    All passwords in iCloud Keychain will be deleted, and iCloud Keychain will be turned off on all your devices.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .