1

If someone had physical access to my iPhone, could they see the stored passwords for my WiFi or email that are represented as black circles and not actually the password itself, e.g. under my mail settings in the password field it shows ●●●●●.

No one has had access to my phone but I just wondered. Similarly, if an iPhone was hacked during a phone call (which I have been assured elsewhere it cannot be but let's assume it could be) could the hacker remotely see these passwords, although I guess the answer will be the same to both.

Improve this question

2 Answers 2

Reset to default
2

The phone should know these passwords if it wants to use it, so it obviously keeps them somewhere in a readable format. If the phone is compromised the attacker would be able to read them. That's actually why some mail providers (GMail, etc) are moving to oAuth so that the phone stores a revokable token instead of the actual password.

While that is possible, I don't think anyone is going to bother modifying the UI code to get what is hidden under the *** characters, rather they would directly get the value from where it is stored even before the UI is involved.

Improve this answer
2
  • Please could you explain what is meant by "they would directly get value from where it is stored even before the UI is involved".
    – Laura
    Jun 30, 2016 at 15:04
  • 2
    @Laura when you open the WIFI settings, the settings app reads the password from a file or a database before displaying it in a censored format. Rather than modifying the user interface code to undo the censoring and extract the value from there, the attacker will directly access the file/database and get the password from there.
    – André Borie
    Jun 30, 2016 at 15:14
0

If you have a newer iPhone (> 4s) just turn on your passcode. It will encrypt all the data on the phone, so even if someone has access to your device, without the PIN / Password to the phone, it's useless.

Improve this answer
9
  • my device requires a passcode to be entered to be used. Do you mean this protects my phone because no one should be able to guess my passcode and log in OR do you mean the passcode actually encrypts data so if someone did bypass it they could see the *** out passwords but nothing else?
    – Laura
    Jun 30, 2016 at 15:02
  • 1
    @Laura the latter. Implementing a passcode turns on disk encryption. The most likely vector (as mentioned by others) is not that the user deobfuscates the black circles, but rather that they mount the phone from another device and poke around in the respective file locations. With the disk encrypted, they won't be able to access those locations.
    – HashHazard
    Jun 30, 2016 at 15:05
  • so my passwords would be safe if my phone was ever in someone else's hands? Could I ask your opinion on whether an iPhone can be hacked during a phone call?
    – Laura
    Jun 30, 2016 at 15:09
  • I saw your post from yesterday and I think the answer given is appropriate. Hacking a phone while it's in use (as a phone) is probably still a bit of a James Bond story line -for non-3LetterAgencies anyway ;)
    – HashHazard
    Jun 30, 2016 at 15:12
  • 1
    Encryption only protects data at rest. Once the phone is turned on and the password was entered at least once, the encryption key is kept in RAM and the partition remains decrypted (so the phone can continue working in background). If an attacker manages to execute malicious code once the partition is mounted he can still exfiltrate sensitive data.
    – André Borie
    Jun 30, 2016 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .