iCloud Keychain for iPhone and Mac Inquiry

MacBookWhooo said:

Hi,

I recently tried out iCloud Keychain and I must say it is awesome. Although I can't recall if I used an iCloud security code or just used my Mac's login password. Now when I checked out the Settings of my phone then went to the settings of Safari, there is a way there for me to see my iCloud passwords right? Well, the problem is that I can see them without any iCloud security code prompt or a password prompt. I can just see my passwords in as easy as just tapping my phone.

Another thing, can I use the iCloud Keychain on Google Chrome for OS X and for the iPhone? How about third-party apps?


Thanks.

Click to expand...

iCloud Keychain will work for any application that uses the Keychain. Google Chrome uses its own password syncing service through your Google account if you have one hooked up.

I just took a look at Settings on my phone and it only showed a locally stored password from before I used iCloud Keychain and it required my passcode to view.

MacBookWhooo said:

It shows all of my passwords in Keychain. I never saved any passwords on my phone before I used iCloud Keychain. It shows everything. It didn't even bother to ask me for a passcode.

Click to expand...

Do you use a passcode on your phone?

MacBookWhooo said:

Nope, none. Only on my Mac.

Click to expand...

Mine asks for my device pass code. I will provide this as feedback.

MacBookWhooo said:

Please help me out

Click to expand...

I would lock your device with a passcode. I reported this to Apple.

MacBookWhooo said:

I hope they'll be replying to your report soon.

Yeah, so temporarily I have to lock the device with a password?



By the way, I am now planning to totally erase everything on my phone and just install iOS and restore everything. Do you think that would work out?

Click to expand...

I do not think restoring iOS would do anything. I have replicated the fact it doesn't ask for a pass code. Setting a device lock pass code, resolves the insecurity, but it definitely should require an iCloud pass code.

MacBookWhooo said:

Exactly.

Click to expand...

Either way, I reported it to Apple. I recommend setting a passcode in the mean time if you are concerned.

MacBookWhooo said:

Thanks. Btw, I wiped my phone, like totally reinstalled iOS. I'll be checking if it's fine now.

Click to expand...

Okay. Let us know.

MacBookWhooo said:

Any updates?

Click to expand...

Sorry I didn't reply. I got an email back from the security team. Here it is:

Hello (Name Hidden),

Thank you for contacting the Apple Product Security team. We take every report of a potential security issue very seriously. This message is being sent to you by a security analyst who has reviewed your note.

Physical security, i.e. preventing others from taking unwanted actions at the device, is an important aspect of securing a system. The scenario you described is an example of loss of physical security. However, iOS offers a security feature to prevent this situation: the passcode lock. The following Apple Support Knowledge Base articles provide details on enabling this feature:

http://support.apple.com/kb/HT4113

We recommend you take advantage of this feature if you're concerned about the physical security of your iPhone.

Best regards,
Brandon
Apple Product Security