During watch mac unlocking setup, iPhone prompts for laptop user password, but iOS security guide (last updated at May 2016) does not describes, how that password will be used.

  • Does iPhone needs it only for initial iPhone-Mac-Watch tethering, or maybe it saves password and uses it for every unlock?
  • Does it send password (encrypted or not) to iCloud services?
  • Do I have to provide new password to iPhone and Watch after I'll change it on Mac?

I've tested most of your scenarios and don't believe the password ever leaves the Mac. Instead, Apple builds up a cryptographic key pair to sign packet exchange between the watch and the computer with anti-replay aspects and time of flight calculations to ensure the watch is really sending the packets now in real time before the unlock happens.

The anti-replay means that you can't record those packets and then play them later to unlock the Mac. Basically Apple leverages the iCloud security that is set up for two-factor authentication and keychain syncing to exchange the cryptographic keys needed to sign the data to establish a verified signal and prevent hacking into your Mac with a synthetic or bogus signal.

The iOS 10 security guide is not out yet nor is the watchOS 3 guide. I'll update this post if I can find more technical details going forward.

  • I've tested most of your scenarios and don't believe the password ever leaves the Mac - But during tethering setup iPhone asks for that laptop account password for continue and that's the step that bothers me (actually, it bothers not me, but guys from it security at my work, currently they disabled that feature at all, because it's not clear, how that typed password is used by iPhone). – Resure Nov 2 '16 at 19:09
  • Can you please check one more usecase: if you setup unlock via watch and then change laptop account password, would you need to enter laptop password on iPhone again? – Resure Nov 2 '16 at 20:16
  • macOS password never enters on phone. – bmike Nov 3 '16 at 2:45
  • Hmm. I clearly remember that it asked me to enter that password. Maybe it requested that because my work mac is connected to domain. – Resure Nov 3 '16 at 11:08
  • @Resure You would have to enter an admin user and password on the Mac to change the keychain settings - so if your local admin account is bound to AD - that lines up. You could also have a local admin account with a junk name/password combo like "me/me" and use that to authenticate as admin. Also, when iCloud account is used on a local account - that too could get mixed up - but again - the Mac password is only used on the Mac. – bmike Nov 3 '16 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .