Fresh install already has all website passwords - from where?

Discussion in 'OS X Yosemite (10.10)' started by propower, Dec 25, 2014.

  1. propower macrumors 6502a

    Jul 23, 2010
    Hey all

    I booted from an external disk and repartitioned my 2012 MBA (erased first then repartition). I then did a clean install of 10.10.1. I logged into iCloud and loaded Safari. Note - I never used iCloud keychain!

    So to my surprise Safari has all my passwords from the last few years already in the keychain. Where did these come from??????

  2. fisherking macrumors 603


    Jul 16, 2010
    ny somewhere
    you didn't copy any settings or files over? perhaps the keychain file is backed up in icloud? (even tho you're not 'sharing' it with an idevice)?
  3. propower thread starter macrumors 6502a

    Jul 23, 2010
    Copied nothing! Just a fresh install

    So does keychain store these with my apple id?? I thought you had to turn iCloud keychain on to do this - I have never done this.
  4. Ravenis macrumors member

    Feb 4, 2014
    Is safari selected in iCloud system preferences? Probably brought them over with that
  5. propower thread starter macrumors 6502a

    Jul 23, 2010
    Yes Safari is selected in System Preferences - iCloud. But isn;t this just for sharing tabs? I tried looking up exactly what this option does and find no clear answer. Also - if this gets passwords - what is iCloud-keychain for?

    Very weird...
  6. fisherking macrumors 603


    Jul 16, 2010
    ny somewhere
    sharing the keychain brings it up on the mac, and an iphone/ipad. my guess is you're just backing it up in the cloud, so it's obviously just copied back from there...
  7. propower thread starter macrumors 6502a

    Jul 23, 2010
    iCloud has a box for Safari (checked)
    iCloud has a box for Keychain (not - checked)

    What does "sharing the keychain" mean?
    How have i enabled it - and how do i disable it?
  8. jbarley macrumors 68040


    Jul 1, 2006
    Vancouver Island
    Safari's cookies will contain those passwords, which you indicate are being saved to the cloud and subsequently being restored.
  9. NoBoMac macrumors 68000

    Jul 1, 2014
    Not having done a clean install of 10.10, have not seen initial setup wizard, speculation, can see happening:

    • Keychain set-up on iOS device(s)
    • Setup Mac: asks for iCloud ID and turns everything to "on".
    • Keychain data gets pulled from iCloud
  10. propower thread starter macrumors 6502a

    Jul 23, 2010
    I have passwords from sites that do not have cookies on my machine so the notion that restored cookies from iCloud put passwords back on my machine appears incorrect.

    I don;t think it is good or right that anything having to do with any passwords should be done without the OS asking my permission or clearly stating what the results of clicking an option are. I check Safari and iCloud because by all of the Apples published data - this lets me share tabs and continue reading from one device to another. the notion of passwords being auto loaded to my keychain is wildly egregious in comparison to sharing tabs. Since there is a very specific checkbox for Keychain I find this auto Keychain behavior very unsettling.
  11. Ravenis macrumors member

    Feb 4, 2014
    just tested in a new user

    skipped apple ID sign in-opened safari-clean as expected-nothing came over

    quit safari, signed into iCloud, everything tried to get enabled including iCloud keychain-cancelled that and left the main services on including safari

    launched safari-tabs and bookmarks showed up, no saved passwords

    so the expected behavior is that it shouldn't show them on a fresh install, yours remains a mystery

    You call and ask apple about this by any chance?
  12. propower thread starter macrumors 6502a

    Jul 23, 2010
    Just to be sure - You checked in Safari-Preferences-Passwords and there was nothing there?
  13. leman macrumors G3

    Oct 14, 2008
    I'd suggest the following:

    1. Start the Keychain Access app
    2. Search for one of the mysteriously stored passwords (e.g. 'ebayuser')
    3. Look which keychain the item is in
  14. xMacFeinx macrumors newbie


    Dec 21, 2014
    Seattle, WA
    When I started up my Macbook Pro this happened. I hadn't been using keychain at all either so to my surprise all my passwords were already saved in Safari. It looks like theres a way with iCloud + Safari that it'll store your logged passwords and enter them when you install/update Safari and sign into iCloud.

    I'm not 100% clear on how or what settings this involves, but at the time I wasn't use KeyChain and as stated before my passwords were stored and then uploaded into my new Mac.
  15. propower, Dec 26, 2014
    Last edited: Dec 26, 2014

    propower thread starter macrumors 6502a

    Jul 23, 2010
    OK - I followed this and all of my only keychain is one called "login". All the internet passwords look the same with a "date modified" field all equal to the date and time i logged into iCloud... some of the ones whose sites I have now been to have more recent times.

    Its almost convenient - and i never store critical passwords - but I really don;t like not knowing why such an important behavior like this would go on without user authorization.

    Interesting :)

Share This Page