1

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what difference it makes if I try to access the data or someone else if there is no password.

I can imagine that data is send over the network encrypted with a random local stored key. But for local storage, the key would have to be stored at the same place as the data making the encryption useless. Is that correct?

2

Essentially, yes. However newer devices have a key built into the device that can't be read, only used (the 'Secret Enclave').

Based on that, IOS provides something called the Data Protection API (DPAPI) to apps. You can only crack that if you jailbreak the device and know the device's passcode.

Edit - I said "essentially yes" because I'm a bit cynical about the passcodes people choose - a 6 character alphanumeric passcode would (says Apple) require >5 years to crack, but 0000 or 1234 will be quickly guessed of course

  • Just to clarify, that means the data is protected by the password inputed to unlock the phone? Isn't that the pin of SIM? Is the pin on the SIM impossible to retrieve (except by brute force)? – Nathan Dec 9 '15 at 14:09
  • The phone unlock code. The SIM code is separate. And this uses the TPM chip in the device. – Natanael Dec 10 '15 at 8:23
  • No the device passcode can be set separate from the SIM PIN. Remember there are IOS devices without SIM cards. There is an iPod Touch next to my keyboard right now. :) – Mark Koek Dec 10 '15 at 9:15
  • 1
    The key is actually a combination of a buit-in hardware key and the passcode set by the user. – Mark Koek Dec 10 '15 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.