Hacker News Reader

They probably encrypt the export with some kind of hash that is then securely transported to the new machine, decrypt it and import.

Maybe someone can reverse engineer, attach a debugger and confirm, or analyze the traffic with a Transparent MITM Proxy on the new machine. Just grep for your password in the traffic captured, should be easy.

And then write a blog post about that. Let's see what happens.

View on HN

Or you could read their published security guide at https://help.apple.com/pdf/security/en_US/apple-platform-sec...

For the May 2024 version the section on iCloud Keychain is on page 158.

I'm not in this field so I don't have time to read these documents. But I checked it out, and...from my understanding the document describes that they can't see your passwords because they do on device export+encrypt and new device decrypt+import.

Is it like that in reality? Should be easy to confirm with a MITM Transparent Proxy, someone should try to find out. Just out of curiosity.

It's exciting to find a company like Apple making a mistake, and they do make mistakes, but boy do they have quality software and it's getting better by the day. Just have a look at their SDK and interfaces: uniform and practical.

Reply on news.ycombinator.com