11

I have a phone and the only explanation I can arrive at is the app is re-identifying my device via keychain data, even after reinstalling the application.

Is there a way how I can remove the keychain data from my phone to test if the Keychain is leaking identity? I am not talking about passwords only, the app saves some data and I need to remove it.

I am okay removing all keychain data from my phone. All answers I see on the internet are for Mac. I am looking for something that works on iOS.

I want to make sure ALL data is removed and that an app does not have knowledge of a previous session.

Improve this question
5
  • Removing an app removes all its data. If anything is retained after a new install, then it is data held by the company that made the app, not data on the phone itself.
    – Tetsujin
    Commented May 15, 2022 at 14:59
  • @Tetsujin That data must somehow be related to my apple id right? Is there any way I can delete that data?
    – J. Doe
    Commented May 15, 2022 at 15:01
  • Best to ask the developer.
    – Tetsujin
    Commented May 15, 2022 at 15:04
  • 6
    @Tetsujin Your comments contradict information given by apple developer support, please consider removing them.
    – andrew
    Commented Aug 7, 2022 at 14:11
  • We don't know the iOS version on OP's iPhone, and, therefore, don't know if the Apple Developer Support apply.
    – DavidRecallsMonica
    Commented Aug 7, 2022 at 14:25

2 Answers 2

Reset to default
9

Yes, I too was surprised to find an app where, despite the warning when deleting the app that all data would be deleted too, a reinstall retains all account information and data. The app I encountered does not use iCloud at all. I’m guessing it stores an identifying token in the device keychain and uses that token to retrieve data from a server.

According to Apple Developer Technical Support person ‘Quinn “The Eskimo!”’ on the Apple Developer Forums,

  • This is currently expected behaviour despite being ‘an obvious privacy concern’
  • Apple tried to fix this around 2017 but enough app developers complained that they decided to keep it
  • However, Apple could theoretically fix this in the future without warning

For now, it seems that completely wiping your device before re-installing apps is the only practical way to go. And don’t restore from a backup after wiping either, as the backup could contain the old keychain data.

To quote some of the details Quinn ‘The Eskimo’ gave:

First, a timeline:

  • All versions of iOS prior to 10.3 beta preserve keychain items when an app is deleted.

IMPORTANT This was most definitely an implementation detail of the original iOS keychain. Our keychain documentation has never specified what would happen in this case.

  • 10.3 beta included a change that deleted such items.

  • That caused compatibility problems (apps were relying on the existing behaviour, even though it wasn’t documented), so it was rolled back before 10.3 GM.

  • iOS 11 introduced the DeviceCheck framework, which provides a forward path for one of the most common legitimate use cases of this behaviour. For more info on this, see WWDC 2017 Session 702 Privacy and Your Apps.

Second, preserving keychain items on delete is an obvious privacy concern. As far as I know Apple has not made any specific announcements as to how we intend to resolve this issue (1). However, I don’t think it would surprise anyone if the 10.3 behaviour returned at some point in the future. I would hope that we’d be more proactive about announcing such a change -- for example, talking about it at WWDC -- but, as always, I can’t make any promises about The Future™.

Improve this answer
7
  • Do you have an Xcode project that demonstrates this on iOS 15? My hunch is some apps are abusing / detecting other identifiers not in the Keychain for this to be ongoing now that Apple patched their implementation of Keychain cleaning. We really need to know which app OP is trying to evade… (or if you’re willing to name such an app publicly or privately)
    – bmike ♦
    Commented Aug 7, 2022 at 15:57
  • apps.apple.com/us/app/little-rock-311/id1061506045 Despite having uninstalled the app with the option to delete all data, when I look in the device keychain I still see com.connectedbits entries. This is iOS 15.
    – andrew
    Commented Nov 25, 2022 at 22:51
  • @bmike "some apps are detecting other identifiers not in the Keychain" – what other identifiers could they be looking at? "now that Apple patched their implementation of Keychain cleaning" – doesn't this mean the Keychain won't be cleaned upon app uninstallation?
    – Oion Akif
    Commented May 4 at 18:06
  • @andrew "when I look in the device keychain I still see" – how do you look into the local keychain of the device? I figured this would only be possible with a jailbroken device
    – Oion Akif
    Commented May 4 at 18:07
  • @OionAkif it’s up to the developer to store things. Some may choose keychain, other NSUserDefaults, other server side, other Apple advertising identifiers iirc. Here’s one blog explaining a multilayered approach to this “surveillance” medium.com/@miguelcma/… I would focus on DeviceCheck framework linked above and here.
    – bmike ♦
    Commented May 4 at 19:28
0

Keychain data is stored (assuming you are signed into your Apple Account on the phone) in iCloud and synced to all your devices signed into iCloud.

On your iPhone you can turn off iCloud Keychain in:

Settings > [Account name] > iCloud > Keychain

Just turn off iCloud Keychain and (assuming that App does indeed use iCloud keychain) will all be gone from your phone.

Improve this answer
2
  • 1
    "the app saves some data and I need to remove it" - I don't think this is actually keychain.
    – Tetsujin
    Commented May 15, 2022 at 16:14
  • That’s my thought @Tetsujin . I’m guessing the application retrieves a generated device identity hash / token / ID and stores that off the phone in an app but the question really needs to be clarified…
    – bmike ♦
    Commented Aug 7, 2022 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .