2

Recently, Apple logged me out of my Apple ID and made me go through a new procedure where I used my recovery key, and was asked to provide my machine login info, and my iPhone unlock code to be able to access my account. (I was also told that recovery keys were no longer usable, unless I changed setting to enable them, though it's not clear how.)

Is this part of a new Apple security policy? Does Apple now have my machine login info; my iPhone unlock code?

Improve this question
1
  • I can't speak of any Apple security policies but I have noticed that some Apple-specific logins now ask for the the Mac's user password to authorize login. I don't think that it is actually sending your local credentials to Apple, rather just your Mac confirming that you are authorized as you have the login password, and logged in successfully.
    – Steve Chambers
    Dec 7, 2020 at 22:49

1 Answer 1

Reset to default
2

This isn't new. While I can't speak to the exact moment this was added, you can rest assured knowing that your passcode/password is safe. What Apple is doing here is verifying your identity by taking advantage of the fact that you use iCloud Keychain. iCloud Keychain escrow is a fairly complicated procedure, but in essence Apple never sees your passcode, it can only see that their hardware modules granted you access to your escrowed bag which proves that you know the passcode to your devices. It's a really neat solution for account verification!

For more info, see page 86 of the Apple platform security whitepaper.

Improve this answer
2
  • But I don’t and never have used iCloud Keychain. In fact I’ve avoided it. Have I now been forced to?
    – orome
    Dec 7, 2020 at 23:47
  • I've done some security work attacking Apple IDs and I've found this mechanism is only enabled when you have, at some point, activated iCloud Keychain. Apple is really insistent that you enable it and stuffs it into the default setup flow. If you have ever enabled keychain, it'll be on forever and you'll be prompted to authorize every new device which is how Apple ends up with a way to verify your device's password/pin. Now, this could have changed but I haven't found much evidence for it and their security docs don't have any indication of it afaik
    – Allison
    Dec 8, 2020 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .