APPLE KEYCHAIN PASSWORD

In Keychain data protection overview Apple defines the available protection classes for the different types of keychain items via the kSecAttrAccessible attribute.

APPLE KEYCHAIN PASSWORD

the password databases used by third-party password managers. These are used to encrypt and decrypt sensitive information, e.g. Microsoft Authenticator or Google Authenticator). A good example of such data are cryptographic seeds used by TOTP-compatible authenticator apps (e.g. As an example, you may be able to use extracted tokens to sign in to Facebook, Google Account and other online services. By extracting authentication tokens, experts may be able to access some of the users’ accounts without the need to login with a password while skipping two-factor authentication checks, where applicable. These tokens are used to automatically authenticate users to online services without prompting for login and password. The additional pieces of information stored in the keychain by the system and apps may include: Pretty much everything else cannot be viewed or otherwise accessed via the GUI. Websites & App Passwords mostly contain authentication credentials (logins and passwords) users save in Safari and some of the apps via Shared Web Credentials. Only parts of that data are accessible to the user right from the device ( | | ). You use the keychain to store these items as well.” For example, the cryptographic keys and certificates that you manage with Certificate, Key, and Trust Services enable the user to engage in secure communications and to establish trust with other users and devices. You can also store items that the user needs but may not be aware of. You can store other secrets that the user explicitly cares about, such as credit card information or even short notes. The keychain is not limited to passwords. However, system-wise, the keychain stores a lot more than meets the eye.Īccording to Apple developer documentation, the keychain is “…a mechanism to store small bits of user data in an encrypted database called a keychain. Most users know the keychain as a password manager keeping their authentication credentials, payment card data and similar bits and pieces of information. However, such keychain records still part of local and iCloud backups they are wrapped with device UID, and can be only restored from a local or iCloud backup onto the same physical device (same UID) they were saved from. Note that many things other than passwords (such as encryption keys, certificates and payment cards) will not synchronize to iCloud as they are not marked as kSecAttrSynchronizable. If iCloud Keychain is activated, users restoring their devices will automatically receive all of their Safari passwords on their new device. iCloud Keychain is a service that synchronizes keychain records featuring the kSecAttrSynchronizable attribute via iCloud. In addition to the device keychain, there is also entity with similar name that lives in the cloud. iCloud Keychain availability by country and region.This service has a name of iCloud Keychain. The Apple ecosystem offers an easy way to synchronize keychain records across devices. We’ll have a detailed discussion of the hidden treasures of the keychain in the next chapter. Cryptographic keys are used to encrypt, sign, and verify information. Certificates and identities are used to securely identify users in tamper-evident way. What is not visible to the user (but accessible to iOS developers) are Certificate, Key, and Trust Services. This is how Apple depicts keychain services in the developer documentation. Applications use the keychain to store identities and authentication tokens, encryption keys and certificates. However, there is a lot more to the keychain than stored passwords. Users can access their stored passwords by opening the Settings app and navigating to |. Password auto-fill service is available for both the Safari browser and apps. iOS prompts users to save passwords users type in Safari. The visible side of the keychain is passwords. Let’s talk about the keychain, its content and its protection, and the methods used to extract, decrypt and analyze the various bits and pieces. The common knowledge is missing the point: the keychain contains literally thousands of records belonging to various apps and the system that are required to access lots of other sensitive information. The common knowledge has it that the keychain contains the users’ logins and passwords, and possibly some payment card information. At the same time, the keychain is relatively underexplored by the forensic community. Containing a plethora of sensitive information, the keychain is one of the best guarded parts of the walled garden.

The keychain is one of the hallmarks of the Apple ecosystem.

Apple keychain