2

Recently (newly with iOS 11 for me, but apparently earlier for others) my iPhone has asked for my Mac password, indicating that until I provide it, certain features (on iOS?) will be unavailable to me.

Is this stored somewhere once requested. If so where is this password stored?

7
  • Sorry, but I am unsure what you are asking... Are you asking where your user account password is located (if so, Keychain Access)? Or where apple stores your password from your mac (iCloud Keychain)...
    – bret7600
    Commented Sep 20, 2017 at 21:27
  • @bret7600: I'm asking where the Mac password (the password I use to unlock my Mac) requested by iOS is stored. Are you saying it is indeed stored on my iPhone (by "where" I mean what device and in what form) now? (FWIW, in my case, Apple does not store any passwords from my Mac in iCloud.)
    – orome
    Commented Sep 20, 2017 at 21:33
  • How could we know the code on iOS and whether the password is salted / encrypted / hashed / used to unlock a keychain or otherwise authenticate? My guess is we’ll get an updated 50 page PDF on iOS security in a couple of months for iOS 11 when Apple documents what it ends up implementing.
    – bmike
    Commented Sep 21, 2017 at 16:29
  • @bmike: Are you saying this answer may not be correct?
    – orome
    Commented Sep 21, 2017 at 16:30
  • I saying - this is going to be highly speculative unless / until someone jailbreaks the iOS and/or understands and reverse engineers the secure enclave. I doubt apple will release anything other than an overview of what users should do and how it architected the security - not the details or code.
    – bmike
    Commented Sep 21, 2017 at 16:32

1 Answer 1

3

With public key cryptography, It's not necessary to store any password on a technical level.

Apple could implement a “use once locally and securely destroy immediately” algorithm as part of key procurement (to decrypt keys used for encrypting data marked as 'secure' on iCloud such as Health, where the keys are based in part on device password) to derive cryptographic keys have been generated based on your current device passcode, apple keys, or other factors.

11
  • So the password is just used once to generate some kid of passcode and then is deleted?
    – orome
    Commented Sep 20, 2017 at 21:55
  • And: Just to make sure we're talking about the same thing: this is the password to my Mac, not for iCloud and not my for keychain; but the account password for my Mac (that's what's explicitly requested) that I use to unlock it and access my user account there.
    – orome
    Commented Sep 20, 2017 at 21:56
  • @rax Precisely! Yes, iCloud bases keys partly on your local password/passcode, so they can claim they are unable to decrypt your data and be truthful about that statement!
    – grg
    Commented Sep 20, 2017 at 21:56
  • So there's an iCloud key of some kind that got generated on my Mac at some point (using my user credentials there) and this is just a way of trustily getting that key over to the iOS device so the iOS device can use iCloud?
    – orome
    Commented Sep 20, 2017 at 22:00
  • @rax Yes, exactly. Just to clarify the ‘getting over’, it's not transferred literally from your Mac, just regenerated from iCloud and the password you provide, so your Mac doesn't need to be available (which is what allows you back into your data if your Mac is stolen, as you know the local account password for it and can provide it back to iCloud when requested). Asymmetric encryption is wonderful! :)
    – grg
    Commented Sep 20, 2017 at 22:08

Not the answer you're looking for? Browse other questions tagged .