Can you explain how this hack would work ?
Would someone need to steal two of your devices ?
I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
Would someone need to steal two of your devices ?
I was under the assumption that you need to be logged in with touchid/faceid/pin code to get the unlock code
They then have everything they need to take over your iCloud account (kicking you out of it in the process by resetting all other devices capable of resetting it) and can see all your passwords stored in it, as well as use all of your WebAuthN passkeys.
I'm not sure if having a recovery code would improve that situation, but I'd guess that many people don't.
Hard to mitigate somebody looking over your shoulder, this is the case with most password managers, but I understand why this is a more likely scenario.
If somebody watches me enter my passcode and then rips the device out of my hands and runs off with it (assuming the password manager is not open), they now have access to most of the content on my phone, but importantly not the parts protected by Face ID, which includes the password manager.
If I had used Apple's password manager instead, they'd be able to recover all passwords (using the tactics described above or simply enrolling their own face in Face ID, which is possible using only the passcode).
Some apps don't, and some even react really poorly to a change of the biometric set (i.e. crashing at every Face ID use with no way to reset other than reinstalling), so I'm also not too keen on testing this on my main device.
One thing that surprised me during my limited testing was that Apple apparently doesn't make use of this capability for storing the "encrypted notes" passphrase, which effectively also reduces the security of that to that of the device passcode.
[1] https://developer.apple.com/documentation/security/secaccess...