1

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what difference it makes if I try to access the data or someone else if there is no password.

I can imagine that data is send over the network encrypted with a random local stored key. But for local storage, the key would have to be stored at the same place as the data making the encryption useless. Is that correct?

Improve this question

1 Answer 1

Reset to default
2

Essentially, yes. However newer devices have a key built into the device that can't be read, only used (the 'Secret Enclave').

Based on that, IOS provides something called the Data Protection API (DPAPI) to apps. You can only crack that if you jailbreak the device and know the device's passcode.

Edit - I said "essentially yes" because I'm a bit cynical about the passcodes people choose - a 6 character alphanumeric passcode would (says Apple) require >5 years to crack, but 0000 or 1234 will be quickly guessed of course

Improve this answer
4
  • Just to clarify, that means the data is protected by the password inputed to unlock the phone? Isn't that the pin of SIM? Is the pin on the SIM impossible to retrieve (except by brute force)?
    – Nathan
    Commented Dec 9, 2015 at 14:09
  • The phone unlock code. The SIM code is separate. And this uses the TPM chip in the device.
    – Natanael
    Commented Dec 10, 2015 at 8:23
  • No the device passcode can be set separate from the SIM PIN. Remember there are IOS devices without SIM cards. There is an iPod Touch next to my keyboard right now. :)
    – Mark Koek
    Commented Dec 10, 2015 at 9:15
  • 1
    The key is actually a combination of a buit-in hardware key and the passcode set by the user.
    – Mark Koek
    Commented Dec 10, 2015 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .