2

Recently (newly with iOS 11 for me, but apparently earlier for others) my iPhone has asked for my Mac password, indicating that until I provide it, certain features (on iOS?) will be unavailable to me.

Is this stored somewhere once requested. If so where is this password stored?

  • Sorry, but I am unsure what you are asking... Are you asking where your user account password is located (if so, Keychain Access)? Or where apple stores your password from your mac (iCloud Keychain)... – bret7600 Sep 20 '17 at 21:27
  • @bret7600: I'm asking where the Mac password (the password I use to unlock my Mac) requested by iOS is stored. Are you saying it is indeed stored on my iPhone (by "where" I mean what device and in what form) now? (FWIW, in my case, Apple does not store any passwords from my Mac in iCloud.) – orome Sep 20 '17 at 21:33
  • How could we know the code on iOS and whether the password is salted / encrypted / hashed / used to unlock a keychain or otherwise authenticate? My guess is we’ll get an updated 50 page PDF on iOS security in a couple of months for iOS 11 when Apple documents what it ends up implementing. – bmike Sep 21 '17 at 16:29
  • @bmike: Are you saying this answer may not be correct? – orome Sep 21 '17 at 16:30
  • I saying - this is going to be highly speculative unless / until someone jailbreaks the iOS and/or understands and reverse engineers the secure enclave. I doubt apple will release anything other than an overview of what users should do and how it architected the security - not the details or code. – bmike Sep 21 '17 at 16:32
3

With public key cryptography, It's not necessary to store any password on a technical level.

Apple could implement a “use once locally and securely destroy immediately” algorithm as part of key procurement (to decrypt keys used for encrypting data marked as 'secure' on iCloud such as Health, where the keys are based in part on device password) to derive cryptographic keys have been generated based on your current device passcode, apple keys, or other factors.

  • So the password is just used once to generate some kid of passcode and then is deleted? – orome Sep 20 '17 at 21:55
  • And: Just to make sure we're talking about the same thing: this is the password to my Mac, not for iCloud and not my for keychain; but the account password for my Mac (that's what's explicitly requested) that I use to unlock it and access my user account there. – orome Sep 20 '17 at 21:56
  • @rax Precisely! Yes, iCloud bases keys partly on your local password/passcode, so they can claim they are unable to decrypt your data and be truthful about that statement! – grg Sep 20 '17 at 21:56
  • So there's an iCloud key of some kind that got generated on my Mac at some point (using my user credentials there) and this is just a way of trustily getting that key over to the iOS device so the iOS device can use iCloud? – orome Sep 20 '17 at 22:00
  • @rax Yes, exactly. Just to clarify the ‘getting over’, it's not transferred literally from your Mac, just regenerated from iCloud and the password you provide, so your Mac doesn't need to be available (which is what allows you back into your data if your Mac is stolen, as you know the local account password for it and can provide it back to iCloud when requested). Asymmetric encryption is wonderful! :) – grg Sep 20 '17 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .