1

We're working on an software service that integrates with some of our users' iCloud data. From what I've read the only way to access iCloud on behalf of the user is to have them generate an app-specific password. As far as I know this password is unlimited in scope and duration. We can access all of the user's data for as long as we want unless the user revokes the password. Needless to say, it would be unfortunate for our users if the password fell into the wrong hands. From what I can tell Apple does have aggressive auto-revoke rules, but I couldn't find any documentation about how it works, so it makes me uneasy to rely upon them for security.

How should I store these passwords for my application to use?

Some options I've already considered:

  1. We can store them in cleartext in the database and rely on the user/Apple to revoke suspicious activity on the app-specific password.
  2. Hashing isn't really an option here.
  3. We could encrypt the passwords, but to make this secure we would have to keep the key quite separate from the application and database that the encrypted password is stored in which would complicate the application design/deployment significantly with moderately improved security.

I suppose this is a pretty common problem with iCloud integrated applications. Are there any Apple recommendations on this topic?

  • I did some research on this question and I could not find any source that mentions about expiration on these app specific passwords. I highly doubt that they will be active forever but definitely an area worth exploring. How about you delete these app specific password after certain time interval and have the user generate it again. Have you considered that? – H4X Feb 26 '18 at 22:17
  • What platforms are you developing for? I assumed iOS or Mac OS but you may as well specify it in your question. – korrigan Feb 27 '18 at 6:50
  • This is for a backend service, not a client app – Samuel Feb 27 '18 at 20:30
  • Fine, I have deleted my (now incorrect) answer. Your problem looks like a generic password manager problem, you should look for that instead. Apple is not in the business of providing generic guidance and their documentation is tied to their platforms and tools. If you are looking for actual solutions (and not Apple guidance like in your current question), please consider updating the question with your real problem. – korrigan Feb 28 '18 at 2:48