17

During iPhone update to iOS 10.3.1, I was asked for my password using the correct machine name for my Mac mini. To be clear, the request was not for my iCloud password, my actual local user account password for macOS. This can also happen in the other direction - setting up a Mac may ask for verification for you to enter your iPhone / iPad passcode (and not your iCloud password)

I could not find any information about this kind of access. I was thinking it was security for iCloud and possibly related to two step authorization or two factor authorization. This is the first time I can think of that I entered a desktop password outside of that actual desktop.

I don't have a screen shot but I recall an implication that some files in my Mac are encrypted and need my password. '... need to enter the password for .'

Are there settings I can I control this assuming it's a legitimate part of iCloud setup process or iOS setup process?

4
  • 1
    Sounds fishy. Do you have a screen shot? How did the wording explain it wanted a "desktop password"?
    – bmike
    Apr 9, 2017 at 11:15
  • @bmike. Wording was actually using the correct name I use for the MacMini. Something to do with some files in my Mac are encrypted and need my password. '... need to enter the password for <my Mac name>.' Wish I had a screenshot. The phone was during the after install setup, the 'few more steps' before I could use the phone.
    – bauerMusic
    Apr 9, 2017 at 13:41
  • 1
    I learned something new today - this wasn't in place last time I restored a device. It sure seems legitimate now that I've reproduced it.
    – bmike
    Apr 9, 2017 at 14:37
  • youtu.be/vRnyasv1qbU - it’s the T1/T2 OS - it hashes local passwords as well as other devices if/when iCloud is enabled. It was a brand new feature of the T1 chip when this was originally posted in 2017, and since 2018 all macs ship with the T2, which retained these features and added many more, all accessible in recovery mode - at least, what they let you change!
    – oemb1905
    Oct 12, 2021 at 22:03

3 Answers 3

5

I don’t think we can control how this works since Apple makes the code and policies on the back end.

As far as official documentation for this step, apple says just

To approve iCloud Keychain when you don’t have access to your other devices, follow the onscreen instructions to use your iCloud Security Code.

I think of this as a for, of two factor where they use the device passcode as the second factor instead of you accepting the push notification to another device to authorize.

When you reset all settings or restore a backup from iCloud (or set up a device as new), the Keychain / iCloud and local USB trust pairings are removed and you should be prompted to trust the Mac when it connects to your iPhone.

After the trust setting dialog pops up (if you are connected over USB), there is now a screen that asks you to enter your iCloud password to finish setting up the iOS device. I have not seen the follow on passcode/password page ever until today. In my case, it wanted the passcode on another iPad and not a Mac ( I have two iPads, an iPhone, Apple Watch, two Mac connected to my iCloud account as primary accounts / keychain sync enabled on all).

Enter Passcode for Other iPad

Access to your account is protected by the passcode for "iPad". Your passcode is encrypted and cannot be read by Apple.

In my case, the iPad in question is named iPad Air 2 and there's a blue link with the text "Forgot iPad Air 2 passcode?" Tapping that lets me select another device to enter a passcode. I then selected my Mac Pro and the text changes to:

Enter Mac Pro Password

Access to your account is protected by the password for "Mike's Mac Pro". Your passcode is encrypted and cannot be read by Apple.

I do have two step authentication enabled for my iCloud account so this seems a legitimate change that Apple has implemented recently to secure backups and/or joining a "new" device or OS to the keychain syncing / trust chain.

After entering the password, there was a long delay (the iPad screen went dark) and the next step was the iCloud Keychain dialog which also was slow to continue when I tapped that.

9
  • There was no word of pairing or 'Trust' (which I'm familiar with). I've been searching the web for photos of update setup, iCloud 2FA, desktop, mac, just about every relevant word I could think of. Could not find that specific screen.
    – bauerMusic
    Apr 9, 2017 at 14:14
  • 1
    That's it! Brilliant!
    – bauerMusic
    Apr 9, 2017 at 14:38
  • 3
    Not sure why this is the accepted answer as this post from Apple contains absolutely no information about why they ask for other device passwords (again, like @bauerMusic said, NOT iCloud Trust/password). Moreover, I have not found documentation on how they hash these passwords so as to be able to verify them, but not actually know them (or contain them in text on servers). I would guess they are following best practices, but where have they documented this? This is not the correct answer. This is, moreover, very important - because it happens when iCloud is disabled (but was formerly on).
    – oemb1905
    Apr 15, 2020 at 16:03
  • I believe it’s accepted since it helped the poster @oemb1905 Feel free to ask a new question if you have a slightly different topic or post a better answer here. The site works best with multiple takes on providing an answer in my experience.
    – bmike
    Jul 26, 2020 at 18:13
  • 3
    No, it just ignores the post - the post asked about requesting local device passwords, not two factor authentication and/or clicking Allow on an already trusted device for a 6 pin key (which is what the article cited does). The post asked about where the Apple guiding doc for local password requests is, and that was not provided.
    – oemb1905
    Mar 30, 2021 at 23:31
4

I just went through this for the first time. To avoid entering the other device's password on the new iOS device, I followed this process:

  1. Tap the "Forgot [other device] passcode?" link.

  2. After several confirmation dialogs, this should bring up up a list of other devices to choose from.

  3. Tap the "Forgot passcode for all devices" link at the bottom of the list.

  4. After additional confirmation dialogs, you should receive an alert on your other device(s) prompting you to approve the new device.

  5. Follow the prompts on one of your other devices to authorize the new device.

5
  • That won’t work if keychain has never been enabled as stated in the original post - almost certain. There’s no way T1 can hash a two factor request if no iCloud services have ever been enabled as mentioned by the poster. The poster, being confused and asking questions, assumed this might be iCloud related, but it’s not. Also, when I first commented above, there was little known on the firmware OS that Apple uses. There is now much more information. But again, two factor can’t be hashed in the firmware OS unless iCloud was enabled which poster said it was not.
    – oemb1905
    Oct 12, 2021 at 21:56
  • May no longer work. As of today, when I click "forgot password" I see just 2 options: "use recovery key" or "reset encrypted data". Neither option sounds good. Not sure if the difference is due to my setup or a change from Apple. Since entering complex passwords on phone and (especially) on the watch is challenging, using another device would certainly be preferable.
    – Kay V
    Mar 3 at 18:28
  • @KayV It's almost certainly a change from apple in the 4 years since I wrote this answer. Mar 5 at 0:59
  • @oemb1905 It seems clear you have more insight than any of the current answers. Perhaps you could post an answer consolidating the info from your various comments? Mar 5 at 1:02
  • Yeah I might, when this was first posted apple was very hush hush about the T1/2, but we know a ton more now and this is basically just core functionality from that which is their new BIOS.
    – oemb1905
    Mar 12 at 0:30
2

I had a similar password request and I have a screen shot.

enter image description here

This seems very strange to me. They could send me identification codes to all the devices but why do they ask for a password of a different device? Unless I see an official document by apple, I will not enter any passwords. I do not use icloud anyway.

This request comes without connecting to the mac.

So, here is the solution: Just press: "I forgot the password". The phone will warn you that all the top secret info in the cloud will be deleted. But if you do not have anything in the cloud you can safely ignore this. After this everything is fine. I think apple is a little bit confusing with asking for things it does not need (in cases of users that do not use icloud).

6
  • Excellent. I wish I'd known this earlier. So this has nothing to do with anything but stuff passwords stored in iCloud (of which i have none)? Or does it pertain to other things as well?
    – orome
    Sep 20, 2017 at 21:49
  • Thank you, that worked for me. "I forgot password" was hidden under the keyboard interface on iPhone. Didn't realize it was there.
    – Franco
    Oct 16, 2017 at 14:39
  • 2
    Sure, you can opt to say "forgot password," but the bottom line is that Apple is now hashing device passwords on their servers, whether iCloud is currently enabled or not. When I went to restore an older 2016 mac computer for a resale - despite having turned iCloud and FindMyMac off in advance and signing out - it still prompted me for the password in recovery mode when I did a fresh install. This is ridiculous practice and even worse that they have no transparent documentation on it. It would make sense if still logged in, but not in cases where the icloud service has been disabled.
    – oemb1905
    Apr 15, 2020 at 16:08
  • 1
    " I think apple is a little bit confusing with asking for things it does not need (in cases of users that do not use icloud)." - worse than that, who gave Apple permission to hash/store our "LOCAL" machine passwords on their servers with enabling icloud and/or after removing it? This is a major privacy violation, of course, but I am sure they buried clauses in their EULA (gross).
    – oemb1905
    Apr 15, 2020 at 16:10
  • 1
    Follow up ... even if someone used iCloud fomerly, disabled Find My Mac, a system restore on that device can still prompt for an old/former local password.
    – oemb1905
    Mar 30, 2021 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .