Hacker News Reader

Comment by ssd646 | Hacker News Reader

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

View on HN

Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.

I never said it sends your plaintext password.

It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out.

You are 100% wrong.

EDIT: https://apple.stackexchange.com/questions/467137/are-keychai...

As someone who dove deep into keychain items for a previous write-up, I believe you are misunderstanding this situation. As far as I understand it, many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain that's different than the iCloud keychain, with items that are not sent to iCloud.

And besides all that, to my knowledge your local machine password (the password you use to login) isn't stored in a keychain item, so there's no way it could make itself into the iCloud keychain, or your local keychain.

You may be mistaking some explanations. Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Your local keychain is also not your iCloud keychain, it's not stored in iCloud.

Again, I'm not an Apple developer, so there may be stuff I don't know, but I am a developer in general and I have researched this. The above is my current understanding.

> many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain

Yes. That's pretty obvious to anyone who opens Keychain Access.

On the left you will see the following under "default keychains" :

    - login
    - iCloud

> Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain.

Yes. That's a fundamental, and again obvious requirement. Your keychain has to be encrypted somehow, and this is (IIRC) derived from your user password.

Software developers can further secure keychain by using enclave tied keychain entries[1].

[1] https://developer.apple.com/documentation/security/protectin...

Reply on news.ycombinator.com