0

Please demonstrate how to set up an iPad using sidecar to both a MacBook Pro and an iMac without giving Apple access to your local computer's account password (which can be used to decrypt all of your files offline if someone is physically seated at your powered-off computer).

Rules:

  1. Must have two-factor authentication enabled (because I have an Apple developer account, fml).
  2. All devices must have only one user account.
  3. Switching the iPad between the MacBook Pro and iMac must not require resetting your passwords.
  4. You must not give Apple your correct password in this box*: enter image description here
  5. If you give Apple a fake or alternate password (and then switch the correct password (for #4)) then you must show that sidecar consistently works after the new correct password (which Apple does not have) is in effect.

* Why not just give Apple your password?

Apple claims in the screen before the above "your password cannot be read by Apple". This is a very weak claim. And Apple (or its agent or compelling party) might still guess and verify your password without technically "reading" it. This is how a significant number of password compromises happen in the wild today.

Improve this question
7
  • Hey - the only weak claim I see here is the idea that your local account password leaves your device. Feel free to hit us up in Ask Different Chat if we can help edit / clarify. I did post an answer that I hope helps and can shape a better answer if I missed the mark.
    – bmike ♦
    Dec 30, 2019 at 20:46
  • 1
    You've previously posted here with a link to a blog claiming that Apple takes your admin password when you set up TFA. In which case, as you already have TFA enabled, then the cat/horse is out of the bag/stable.
    – benwiggy
    Dec 30, 2019 at 20:59
  • 1
    Regarding 2FA. Apple has fixed their product and it is no longer necessary for you to leak Apple your password to set up 2FA.
    – William Entriken
    Dec 30, 2019 at 23:17
  • 1
    @bmike There is no claim that the local account password leaves the device. And so that is not a "weak" claim. Specifically, the hashed version of your local account password is what is leaving your device. And even that is unacceptable.
    – William Entriken
    Dec 30, 2019 at 23:19
  • 3
    I support William here. Votes shouldn’t be about disagreeing with a point or because something is going to be very hard to answer. This is +1 in my book and worth discussing technically. I can’t see how this is either “ egregiously sloppy, no-effort-expended post” or entirely unuseful to get answered. Even if people post wrong answers, contravening answers or kind and critical comments can educate everyone.
    – bmike ♦
    Dec 30, 2019 at 23:53

1 Answer 1

Reset to default
1

If you equate giving apple your password to typing the admin credentials, then you can’t do this without a privilege escalation / security vulnerability. Those usually pay $25,000 to $250,000 so if anyone has one - get your money from apple before posting here how to hack your mac.

If you just need us to confirm you aren’t sending your password off device in the prompt you showed, you are set. Use the admin password and understand that Apple doesn’t send your password off the device, it entangles a local key with a downloaded public key and then stores the results in your keychain.

Apple already has your iCloud password so it doesn’t need to record / steal / transmit your local password for sidecar to work. I understand you would love to have someone show you the way, but as I read it, your intentions are good but your threat model analysis is faulty here.

Improve this answer
6
  • I’ll try to set up sidecar and show you the secret that syncs via iCloud to establish that both devices are eligible to secure the highly confidential information you are about to broadcast from your Mac to the iPad. Apple engineering has thought deeply about security and privacy here so that when you set this up, no one else other than you (shown by your local / iCloud passwords) can see the data from mac to iPad and back.
    – bmike ♦
    Dec 30, 2019 at 20:50
  • 1
    I have successfully reported vulnerabilities to Apple. Lest anybody think I'm a whack job, they have publicly credited me here support.apple.com/en-us/HT201536
    – William Entriken
    Dec 30, 2019 at 23:21
  • 2
    I understand that my Apple password is something that Apple and I share. My local password is different and I do not share that with Apple. My local password encrypts the hard disk and gives root access on my machine if I only have one user on the machine. My threat model is my local password, or a hash of it, should not be shared to Apple.
    – William Entriken
    Dec 30, 2019 at 23:24
  • 1
    When you describe "and then stores the results in your keychain" that must necessarily be in Apple's control. Therefore 𝑓(local_key, public_key) is given to Apple. That means Apple could guess and verify the local_key. Therefore threat model violated.
    – William Entriken
    Dec 30, 2019 at 23:26
  • @WilliamEntriken no such thoughts crossed my mind. I’m super appreciative of security researchers and people skeptical of any claim. Fair enough if you either have proof the password is hashed and leaves or just want to be sure it isn’t before typing it. I think we’re all in agreement the password doesn’t have to be compromised to set this up, but whether the design is thusly done.
    – bmike ♦
    Dec 30, 2019 at 23:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .