3

I was curious what iCloud Keychain (which I haven't explicitly stored any passwords in, yet) was storing, so I headed to Keychain Access. There I found an item I wasn't familiar with called EscrowService, which appears to have a Date Modified of around the time I was updating to Mavericks:

EscrowService Attributes view

EscrowService Access Control

Key escrow being very concerning (by definition, it is the storage of a key with a trusted third party), I disabled iCloud Keychain. The item remains in my Local Items keychain, along with other items such as server passwords used by Mail.app and Wi-Fi keys.

Does anyone know what this item is for? I suspect if com.apple.lakitu can be identified, it might be a step in the right direction, but I'm coming up short on searches.

4

Well, Lakitu is the turtle that rides in a cloud and throws spiny bombs at the hero of the Super Mario Bros game.

http://en.wikipedia.org/wiki/File:Lakitu.png

However, I have no such key in any of the Macs which I have enabled iCloud keychain sync, so despite the extremely evocative name of com.apple.lakitu I'm not so sure it's part of the default setup unless it's a placeholder for someone that hasn't yet allowed any keychain items to be stored for syncing?

enter image description here

My only guess is that it holds a key until you establish your syncing or if you do not choose a security code and it stores a self generated code rather than using just your iCloud keychain pin to sync. If you haven't enabled an actual long form security code or added a second device that could be a reason why I'm not seeing this entry and you are.

1
  • Hmm, I wonder if it had something to do with me setting it up on my iPhone first, and (initially) allowing it to use my iPhone's passcode as a lock. I've since undone that, but the item remains. I think it was created when I updated to Mavericks; I'm going to go add that to the question. Also: good ol' Lakitu. 😄
    – zigg
    Oct 24 '13 at 20:36
1

I just today found an article explaining the escrow service for iCloud Keychain.

If iCloud Keychain is configured to use 4-digit iCloud Security Code (which is a default) then there is additional iCloud service involved: "escrow proxy." In a nutshell, escrow proxy holds encryption keys to the keychain items shared via iCloud and provides those keys to properly authenticated clients.

The problem with this, according to the article, is that the 4-digit code is then used to encrypt the escrow key. The 4-digit code constitutes a very weak form of encryption which Apple (or an attacker gaining access to the encrypted data stored with Apple) could brute-force very quickly.

It's been a long time, and I don't entirely recall if I tried the 4-digit code. If I did, that would explain this.

It seems the best advice is to use the long password for iCloud Keychain or avoid it entirely.

1
  • Cool find - good work.
    – bmike
    Feb 26 '14 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .