iOS doesn't delete app login data, that it said it did? Remembers my passwords from TWO YEARS ago?!

[Smartass]

So this just happened - Two years ago i deleted some app like i deleted every app, nothing special here and completely forgot about it. Fast forward to today, when i reinstalled the app and lo and behold - The app already had all of my login credentials and password remembered? Quite Weird i thought to myself, maybe its a passwords app issue - i know it saved it there for quick login. So i deleted the app, went to passwords app and of course there it was - Login data of that app. So i deleted that usernames and passoword and thought to myself that this should do the trick, and continued to reinstalling the app... and guess what - THE LOGIN DATA IS STILL THERE? My username and my password, that ive "deleted"?
Can somebody please tell me, how and why doesnt iOS delete the data that it said it did? And where and why the ****(pardon my french) is it storing my login credentials, when i explicitly told it to delete this? Can somebody please enlighten me here, how and why is this even allowed and enabled? Because if i am not mistaken, iOS/Apple actively fools us into thinking that we have deleted app data and login credentials, when it fact, it did not and is still stored somewhere, without telling me this? How is this not a huge privacy issue?

 

[kpluck]

I don't use Passwords on iOS but doesn't it have a deleted items folder? Maybe it still uses those deleted items, if still present, when you try to sign in.

-kp

 

[BigBlur]

What is the app? Maybe that will help us. A number of things could have happened here...

Have you checked all your users/passwords in the Passwords app? Perhaps there is another one that got associated with the site/app you're using. As an example, you could have one that looks like it's for google.com and only shows up as a Google password in the list...but it could also be associated with apple.com in the websites section when viewing the password.

Do you have other apps from the same developer installed? They can share information between apps. (Can sign into Chrome and it automatically signs into YouTube; or with Meta apps like Facebook and Messenger; or with Microsoft apps like Outlook, Word, Excel, etc.)

Some apps, like Snapchat, can store your login information in iCloud to make it seamless across devices. Check your iCloud settings and see if the app is being synced there.

Other apps can sign in with your Apple ID. You can manage those in Settings > Your Name > Sign in with Apple.

 

[Smartass]

I don't use Passwords on iOS but doesn't it have a deleted items folder? Maybe it still uses those deleted items, if still present, when you try to sign in.

-kp

I did some research on the internet, i didnt quite understand it but, it says it stores ALL login credentials and passwords into iCloud keychain, and this CAN NOT be removed/deleted, EVER?? I'm starting to wander and worry, what else is Apple hiding from us here.

 

[lemimouth]

I did some research on the internet, i didnt quite understand it but, it says it stores ALL login credentials and passwords into iCloud keychain, and this CAN NOT be removed/deleted, EVER?? I'm starting to wander and worry, what else is Apple hiding from us here.

You can delete iCloud keychain items from a Mac (search for the mobile app name and delete it), but not from iOS…

 

[Smartass]

What is the app? Maybe that will help us. A number of things could have happened here...

Have you checked all your users/passwords in the Passwords app? Perhaps there is another one that got associated with the site/app you're using. As an example, you could have one that looks like it's for google.com and only shows up as a Google password in the list...but it could also be associated with apple.com in the websites section when viewing the password.

Do you have other apps from the same developer installed? They can share information between apps. (Can sign into Chrome and it automatically signs into YouTube; or with Meta apps like Facebook and Messenger; or with Microsoft apps like Outlook, Word, Excel, etc.)

Some apps, like Snapchat, can store your login information in iCloud to make it seamless across devices. Check your iCloud settings and see if the app is being synced there.

It seems like EVERY app? I just went and deleted Tinder, went to passwords, no data there, reinstalled app and guess what - all data still there, it's like i never deleted the app?!

This is basically same crap as if when you decide to delete all browsing history from your browser, it would say that it deleted all the history, logins, cache, etc. and then you would still be able to login into every site that you visited prior to "deleting all data", because it never deleted it? WTF?

 

[Smartass]

You can delete iCloud keychain items from a Mac (search for the mobile app name and delete it), but not from iOS…

I don't own a Mac. So this means what now? That all of my previous login usernames and passwords, are stored somewhere in icloud, and i cannot even access that data? I cannot see which data is being stored, and i have no options to decide what data is stored in there, even though we are talking about passwords, that could in theory be abused if iCloud is ever hacked? And worse, Apple told me that all of this data is deleted, even though it is not?
I did quite a lot of research when GDPR came into force in EU, and i am quite sure that this is illegal.

 

[BigBlur]

It seems like EVERY app? I just went and deleted Tinder, went to passwords, no data there, reinstalled app and guess what - all data still there, it's like i never deleted the app?!

This is basically same crap as if when you decide to delete all browsing history from your browser, it would say that it deleted all the history, logins, cache, etc. and then you would still be able to login into every site that you visited prior to "deleting all data", because it never deleted it? WTF?

So with Tinder (and your other apps), did you log in with your Apple account? Go to Settings > Your Name > Sign in with Apple and manage your logins there.

I don't own a Mac. So this means what now? That all of my previous login usernames and passwords, are stored somewhere in icloud, and i cannot even access that data? I cannot see which data is being stored, and i have no options to decide what data is stored in there, even though we are talking about passwords, that could in theory be abused if iCloud is ever hacked?
I did quite a lot of research when GDPR came into force in EU, and i am quite sure that this is illegal.

This doesn't matter. The Passwords app is essentially iCloud Keychain. It will show you all your passwords you have stored there and you can obviously delete them. Apple is not doing anything shady here. If they had, they would have been caught a long time ago...you did not make any sort of grand discovery here.

 

[Smartass]

So with Tinder (and your other apps), did you log in with your Apple account? Go to Settings > Your Name > Sign in with Apple and manage your logins there.


This doesn't matter. The Passwords app is essentially iCloud Keychain. It will show you all your passwords you have stored there and can obviously delete them. Apple is not doing anything shady here. If they had, they would have been caught a long time ago...you did not make any sort of grand discovery here.

What do you mean i didnt make grand discovery here? When i deleted the App, Apple/iOS told me that "Deleting this app will also delete its data." I think this is quite straight forward and quite easy to understand, and it's perfectly reasonable for me as customer, to expect from apple, that when i delete app, that it also deletes its data. NOWHERE does it say, that login credentials will be stored somewhere on apple cloud servers, where i can not ever access it. And if it was not for this today, i would have NO idea this is the case. So what this means is that a millions of people's passwords and login infos of apps that they thought theyve deleted, are stored somewhere in icloud, without them knowing it.
If you think this isnt some discovery, go ask a random person on the street, what do they expect happens to their passwords when they delete their app. I'm sure that 100% of them will answer that they think it is deleted, because that is the only logical answer here, because even iOS tells them that. This means that we never really had control over our logins and passwords, and in theory if somebody somehow unlocks your phone, they can just start login into all of your accounts of apps, that you thought that you deleted long time ago, without you even knowing it. It's a small chance, but peoples phones do get stolen, and some people have shi**y passcodes.

One bizzare scenario: Husband installs tinder, uses it a bit then deletes it. His wife becaomes suspicious, wants him to show that he is not lying and doesnt have tinder. She could then demand from him, that he install it to prove it. Husband thinks "sure no problem, i deleted all the data anyways so it will just demand that i create new account", and when he installs it - BOOM, Tinder is ready to go. Once again, bizzare scenario, but it just shows the issue at hand here

 

[lemimouth]

Well the Passwords app is not “essentially” iCloud keychain, it’s a very basic, limited and “curated” view (the Apple way) of some keychain items.

I have 25 passwords (mainly passkeys in fact) in the Passwords app, but hundreds if not thousands items in iCloud keychain in the Mac app.

For Tinder it’s probably an access token and not the actual password that is stored in keychain. But without a Mac, no way to delete it.

 

[Smartass]

But without a Mac, no way to delete it.

And this is actually quite concerning. What apple does here is it demands from you, that in order to delete this data, you need to buy a mac. IF you even ever get ahold of this info about old passwords stored in keychain(which majority don't).

 

[BigBlur]

Well the Passwords app is not “essentially” iCloud keychain, it’s a very basic, limited and “curated” view (the Apple way) of some keychain items.

I have 25 passwords (mainly passkeys in fact) in the Passwords app, but hundreds if not thousands items in iCloud keychain in the Mac app.

For Tinder it’s probably an access token and not the actual password that is stored in keychain. But without a Mac, no way to delete it.

You're right. iCloud Keychain has more than just passwords; but practically speaking, those other things aren't relevant in this situation, nor do most users need to worry about them. Can you imagine how problematic it would be if Apple/apps were storing important stuff in there with no way to delete them from an iPhone, or to "reset" an app? We'd be hearing many more complaints.

Tinder doesn't use iCloud anyway, so we can rule that out.

I just went and deleted Tinder, went to passwords, no data there, reinstalled app and guess what - all data still there, it's like i never deleted the app?!

Just for giggles, I downloaded the Tinder app, set up an account, deleted the app, and reinstalled it. I got asked to sign in again (by using Apple account, Facebook, or phone number). Are you saying you didn't get asked to sign in again...and all your stuff was just there?

 

[Smartass]

You're right. iCloud Keychain has more than just passwords; but practically speaking, those other things aren't relevant in this situation, nor do most users need to worry about them. Can you imagine how problematic it would be if Apple/apps were storing important stuff in there with no way to delete them from an iPhone, or to "reset" an app? We'd be hearing many more complaints.

Tinder doesn't use iCloud anyway, so we can rule that out.


Just for giggles, I downloaded the Tinder app, set up an account, deleted the app, and reinstalled it. I got asked to sign in again (by using Apple account, Facebook, or phone number). Are you saying you didn't get asked to sign in again...and all your stuff was just there?

Yes.

I found this via reddit. I got perm banned on taccount, deleted the app in mean time, then yesterday made a new account, used it for one day, and then bam - banned for "evading previous ban" even though i used a completely new email. It actually knows who i am, based on previous accounts, that dont exist any more. It also gave me an option to login with old account that was deleted some time ago. Basically what this keychain does, is give info to apps and sites on who you are, even if you start from scratch, or want to retain some sort of privacy. It activelly lets different apps track you and identify you, without you even knowing it.

If i was some whistleblower, made a new account on let's say reddit, to post some sensitive whistleblower data, they would instantly know its me. Once again, bizzare and probably rare scenario, but considering whistleblowers have been killed in past, imagine what this can do to people.
What this means is that this keychain is a very serious breach of privacy, and Apple knows it, and is intentionally lying to its users/customers.

If somebody gets ahold of your phone, and unlocks it, they can basically trace your every account that you ever used on iPhone/iOS. At this point, Android seems more safe for privacy than the iOS(which is bonkers to be honest)

 

[Cobalt Blizzard]

I’d recommend you to check iCloud sync/backup settings. Some apps store auth tokens here. As an example, I have a WhatsApp where I don’t need to login every time I reinstall app.

 

[BigBlur]

Yes.

That is odd. Maybe try deleting the app, wait a few mins, reboot the phone, and try again.

I got perm banned on that account long ago, deleted the app in mean time, then yesterday made a new account, used it for one day, and then bam - banned for "evading previous ban" even though i used a completely new email. It actually knows who i am, based on previous accounts, that dont exist any more.

Are you using the same device you got banned on? It could be a hardware ban based on your device ID.

Do you use Sign in with Apple? Go to Settings > Your Name > Sign in with Apple to manage those login accounts there. (They don't show up in Passwords.)

 

[Lounge vibes 05]

One bizzare scenario: Husband installs tinder, uses it a bit then deletes it. His wife becaomes suspicious, wants him to show that he is not lying and doesnt have tinder. She could then demand from him, that he install it to prove it. Husband thinks "sure no problem, i deleted all the data anyways so it will just demand that i create new account", and when he installs it - BOOM, Tinder is ready to go. Once again, bizzare scenario, but it just shows the issue at hand here

Yes.

I found this via reddit. got perm banned on taccount, deleted the app in mean time, then yesterday made a new account, used it for one day, and then bam - banned for "evading previous ban" even though i used a completely new email. It actually knows who i am, based on previous accounts, that dont exist any more. It also gave me an option to login with old account that was deleted some time ago. Basically what this keychain does, is give info to apps and sites on who you are, even if you start from scratch, or want to retain some sort of privacy. It activelly lets different apps track you and identify you, without you even knowing it.

These are definitely some bizarre scenarios…

 

[Nermal]

This sounds suspiciously like an issue I had a while ago. I never found a "true" solution for the problem.

 

[Smartass]

That is odd. Maybe try deleting the app, wait a few mins, reboot the phone, and try again.


Are you using the same device you got banned on? It could be a hardware ban based on your device ID.

Do you use Sign in with Apple? Go to Settings > Your Name > Sign in with Apple to manage those login accounts there. (They don't show up in Passwords.)

Yes, same device. Didnt use apple to sign in.
This means that Apple has secretly implemented a Device ID "thingy", that you as a user cannot delete. This then is basically like some internet cookie, that stay with you, and lets companies identify your visit every time you use their app. So in case of reddit here, even if i dont use an account, and just use to browse it "anonymously", Reddit still knows who i am. And this is only for reddit that i figured out for now.
Actually the question here is - What the hell does deleting the app even do then? If i am not mistaken, in this case, deleting the app just removes it from homescreen, while all the data is stored somewhere(even though it tells you it will delete all of app data).
So we are already at two privacy concerning things.

 

[Smartass]

This sounds suspiciously like an issue I had a while ago. I never found a "true" solution for the problem.

Interesting. Apple here has some serious explaining to do. They claim to delete all app data, when in fact they do not.

 

[lemimouth]

Spotify doesn’t use iCloud, but if you look in iCloud keychain from a Mac, you see that there are some entries for Spotify. I just tried to delete and reinstall the app and was automatically logged in.

Also, wait until you discover on your Mac a hidden iCloud folder that contains leftover of hundreds and hundreds of config files from apps/games deleted YEARS ago with no way to clean up 😳 (I posted this in an other post a while ago).

Clearly some data will stay forever in your account.