Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

https://lapcatsoftware.com/articles/2024/5/3.html

by frizlab • 2 years ago

88 68 2 years ago

saurik• 2 years ago

This isn't the first time, nor will it be the last: the only reason I'm actually using iCloud Keychain is because, despite always turning it off and feeling like I needed to keep doing it over and over again every time I got a new device, one day I was in a discussion with someone about it and I went to show them how I turn off most of the iCloud features, and I discovered I had actually failed and now had already been using iCloud Keychain and so all my passwords were already in it.

tailspin2019• 2 years ago

I had the exact same experience with iCloud Drive (or whatever it is/was called) years ago. I kept turning it off and never agreed to use it and one day discovered it was on anyway and a bunch of my stuff was already in the cloud.

Pretty egregious behaviour.

Teever4• 2 years ago

Yeah this is the kind of behaviour that I'm hoping the EU will step in and regulate.

It would be amazing the victims of this kind of egregious privacy violating behavior would receive a cut of the fine that the offender is charged.

That would give people an incentive to report this kind of shit.

saagarjha3• 2 years ago

Don’t you feel so much more secure now?

pritambaral• 2 years ago

Can't tell if sarcasm, but if not:

This is precisely the problem. Apple treats its users as dumb cattle. "We know better. Shut up and be happy with what we force down your throat."

Of course, Apple can do no wrong. Forced lock-in? "Don't you feel so much more secure now that you're firmly in our garden? Our walled garden that you cannot escape from?"

plorkyeran3• 2 years ago

Isn't the workaround here to back up your keychain file, remove your passwords from the keychain, update to Sonoma, disable iCloud keychain, then import the backup? Not a trivial process, but should be easier than the author's attempted workaround of disabling SIP and installing while offline.

Long term I suspect the actual answer will be that if you don't want to use iCloud Keychain then you just can't use the keychain at all, which is a shame as it once was one of the good parts of macOS.

lapcat5• 2 years ago

should be easier than the author's attempted workaround of disabling SIP and installing while offline

Disabling SIP wasn't an issue, because I had already done it to eliminate slow app launches: https://lapcatsoftware.com/articles/2024/2/3.html

On my second attempt, I managed to update without an internet connection. See the new addendum to the article.

sunshowers• 2 years ago

Perhaps disabling System Integrity Protection disables the malware scan too? I haven't checked this, but it's not really viable for me as a Mac software developer, because I need to test the same runtime environment as my users, otherwise I could write code that works for me but not for my users.

I'd be a bit careful here by the way. Disabling SIP results in other weird differences too, that may cause programs to run for you but not most of your users.

For example, LD_ and DYLD_ environment variables are no longer sanitized [1] for system processes.

Fun fact: the GitHub Actions Mac environment also disables SIP. So it might run for you and in CI, but not for your users.

[1] https://briandfoy.github.io/macos-s-system-integrity-protect...

nhod• 2 years ago

i understand and agree that this should at the very least have an opt-in dialog box.

that said, apple did add the option for end-to-end encrypted “advanced data protection” for the majority of icloud data a year or so ago.

perhaps they also enabled it by default in sonoma?

https://support.apple.com/en-us/108756

lapcat5• 2 years ago

perhaps they also enabled it by default in sonoma?

No, they didn't.

Anyway, iCloud Keychain has always been end to end encrypted.

TillE• 2 years ago

Right, it's obviously end-to-end encrypted because if it weren't, everyone would have been screaming for years about how horrendously insecure it was.

iCloud Keychain is fine, just use a good password. There's no particular harm in letting Apple store an encrypted blob for you on its servers.

SpikeDad• 2 years ago

And only enabled if 2FA is enabled. It won't work without (as won't many Apple services).

CharlesW5• 2 years ago

Even with so-called standard data protection, iCloud Keychain passwords are always end-to-end encrypted, and Apple cannot decrypt them.

"For additional privacy and security, 15 data categories — including Health and passwords in iCloud Keychain — are end-to-end encrypted. Apple doesn't have the encryption keys for these categories, and we can't help you recover this data if you lose access to your account."

https://support.apple.com/en-us/102651

Teever4• 2 years ago

Apple cannot decrypt them.

How do you know this?

throw20240511• 2 years ago

Gah, I didn’t realize that iCloud Keychain was enabled automatically on ios17. I checked and it’s been on for months. Why would they do this?

I remember when Microsoft uploaded people’s personal wifi creds in Windows 10. It’s all highly suspect.

Stop it. This over sharing by default will doom us all.

ChrisMarshallNY• 2 years ago

Actually, I figured it out, when an app I wrote, that uses the keychain, started allowing me to log into the app, using Sign in with Apple (which has some stuff that is only available when the login is set up), on devices that were not the ones that I set up.

In my case, I liked that, and so will my users.

But I do think that it could be problematic, if this means that authorities could now get ahold of your keychain, when having it restricted to a single device, avoids that.

crooked-v• 2 years ago

Why would they do this?

Because automatically sharing credentials between devices by default is what most people want, especially younger customers for whom this has always been the normal state of affairs.

jkaplowitz• 2 years ago

What you say makes sense for new installs, although even there an explicit and optional consent screen is warranted before doing something as privacy- and security-sensitive as syncing passwords to the cloud. But it's not definitely what's wanted by most people who previously had the feature disabled before the OS update.

LeoPanthera2• 2 years ago

Presumably, only if you already have an iCloud account, and are signed in?

x3n0ph3n3• 2 years ago

Pretty sure that's the case. I don't know why anyone trusts iCloud.

vbezhenar• 2 years ago

Is it possible to use macOS and iOS without iCloud? I never tried.

wila• 2 years ago

I had to blink twice last time when I installed Sonoma on a new partition that I did not have to provide a wifi password. This appears to confirm that. While I can understand that some people would appreciate this, I'm not exactly chuffed by a fresh install silently grabbing passwords from an old install.

LeoPanthera2• 2 years ago

That is not related. Mac computers store the last successful wifi credentials in in the EFI, and use them to give macOS Recovery internet access.

382• 2 years ago

That is fucking terrifying.

spaceguillotine• 2 years ago

if you have an iPhone, iPad or any other logged in device with the wifi password it will auto grab it from that device without you doing anything.

Nextgrid2• 2 years ago

I believe this is just iCloud Keychain in action.

The other commenter is correct - the last (few?) Wi-Fi passwords are stored in NVRAM so that the recovery environment can connect to the network more conveniently.

wilg• 2 years ago

How would it have synced the wifi password from iCloud without the wifi password one wonders?

Ophuscado• 2 years ago

About suspicious things lately, I remember that it regenerated my FileVault (disk encryption) password after the past two updates. It happened to more people out there.

m463• 2 years ago

If people wonder about things, they should install Little Snitch and see how often apple apps phone home. It's amazing. Not only after install, but hours and days later will apps start quietly phoning home.

plausibility2• 2 years ago

One thing I learned from using Little Snitch is that a lot of Apple apps are seemingly immune from these types of firewalls, due to Apple shenanigans around k-ext signing etc [0].

Ref also [1]: > In Big Sur Apple decided to exempt many of its apps from being routed thru the frameworks they now require 3rd-party firewalls to use (LuLu, Little Snitch, etc.) > Q: Could this be (ab)used by malware to also bypass such firewalls? > A: Apparently yes, and trivially so

[0] https://x.com/patrickwardle/status/1318437929497235457 [1] https://x.com/patrickwardle/status/1327726496203476992

lapcat5• 2 years ago

Apple removed the exclusion list: https://obdev.at/blog/a-wall-without-a-hole/

Sporktacular3• 2 years ago

This is not longer the case.

But another way around is the way VMWare Fusion let you set up networking in Bridged mode. Any traffic from the VM went through without a peep from Little Snitch running on the host. No reason malware couldn't be designed in the same way.

rdl• 2 years ago

It didn't for me.

Razengan• 2 years ago

An example of "Keychain" abuse is how Facebook so disgustingly tracks you even after you delete all apps, and can track you even after you restore an iCloud Backup ON A NEW PHONE!

• It shows my previous accounts even after I delete the app.

• Clearing Safari's cache does not work.

• Disabling iCloud Drive and iCloud Keychain does not work.

• Even completely signing out of iCloud does not work!

----

WHY can't the user see this data?

WHY can't the user delete this data without going through the app?

WHAT ELSE do apps store on our devices that we aren't even aware of? (This is just what we can see: The list of saved accounts for "quick login")

HOW MANY other apps are secretly doing this?

WHY does Apple even allow this in the first place??

Worst of all, WHY aren't more people raising more of a ruckus about this extremely appalling practice?!

hn-acct• 2 years ago

Could be stored in keychain.

But I agree. The user should be asked if they want to clear it on app delete

Nextgrid2• 2 years ago

Not "could be", it's absolutely stored in the keychain.

The iOS keychain isn't visible to the user which is the problem.

banku_brougham• 2 years ago

Nobody mentioned this so far, here goes:

The latest 'national security' bill signed into law this April grants the US govt access to any and all commercial hardware. This as I understand it, am I wrong?

Doesnt this imply that every cloud service should be assumed insecure?

plorkyeran3• 2 years ago

Every cloud service should be assumed insecure, but not because of some new law.

luke-stanley• 2 years ago

For people who like the Apple Mac, running an open-source OS on it is usually possible, right?

yencabulator• 2 years ago

The hardware tends to be very proprietary. You can make some parts of it work, but is that worth it?

woleium• 2 years ago

This would put me in breach of NDAs that i have to work under if it happened to me. I guess i could claim damages from Apple?

Updating from macOS Ventura to Sonoma Silently Enables iCloud Keychain

Related Stories