0

I'm currently exploring the idea of using iCloud Keychain now that macOS supports it on Chromium browsers but I don't fully understand the security of it.

I understand that it's end to end encrypted and I do have the 'Advanced Data Protection' on, but what concerns me is the 2FA with a trusted number as SMS always seems to be a weak way to handle 2FA.

It seems like even with a set of security keys installed Apple still forces you to leave an SMS option, but when I try to login it only gives me the option to use my keys.

Does the trusted number work differently once you have security keys - or - can you still request codes that way somehow? If you do request codes via SMS will it unlock your keychain and all end to end encrypted content - or - does that require some sort of other authentication? (The key?) I keep reading that the data is safe even if the account is compromised, but not really understanding how that actually works.

I know the other concern w/ iCloud Keychain is that a 6 digit pin on your phone is a weak point, but if I went this route I'd switch to a proper alphanumeric password to mitigate that.

Bonus question, is the PIN/Password you use to unlock your device stored locally on the device in the secure enclave or something?

Improve this question

2 Answers 2

Reset to default
0

End-to-end encrypted iCloud content cannot be accessed without a third factor, usually the passcode to one of your devices:

Use of secondary authentication

There are several ways to establish a strong passcode:

  • If two-factor authentication is enabled for the user’s account, the device passcode is used to recover an escrowed keychain.
  • If two-factor authentication isn’t set up, the user is asked to create an iCloud security code by providing a six-digit passcode. Alternatively, without two-factor authentication, users can specify their own, longer code, or they can let their devices create a cryptographically random code that they can record and keep on their own.

You can observe this when logging into a new device. After you enter your email, password, and then enter the 2FA code, you'll be prompted to enter the password for a device already on your account. If you cannot complete this step, you are given the option to reset your End-to-End encrypted contents.

iCloud Keychain security overview

Secure iCloud Keychain recovery

Improve this answer
2
  • Ah, got it, so essentially even if someone was able to get ahold of my SIM & password in an extreme situation and accessed the account without my "third factor" -- which I assume would be either the password for my iPhone or Mac? EDIT: Do you also happen to know if you were to lose access to your iCloud account for whatever reason would you still have access to your passwords on the devices that are already setup? Would sync just stop?
    – fyrekcaz
    Commented Oct 13, 2023 at 18:17
  • Yes, my understanding is that a new device would not be able to be added to your keychain and other E2E data without that step. Existing devices would retain it and can re-populate the cloud if a reset is needed.
    – Ezekiel
    Commented Oct 14, 2023 at 22:07
0

After reaching out to an individual at Apple I got confirmation that when hardware keys are used, phishable authentication like SMS-delivered codes are disabled.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .