0

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?

My concern is, if logging into iCloud from someone else's device (or browser), this session cookie could be stored. A malicious person, perhaps unknown to the system owner, could grab the session cookie and username/password from logged keystrokes. Now this person has bypassed 2-factor authentication and can access:

iCloud Keychain, iCloud iOS Backup (with password attack) and much more iCloud data including calendar, contacts, notes, photos, etc...

It seems like a big risk because many people store website passwords, including passwords to encrypted backups (Time Machine), on the keychain. This type of attack could expose all of this.

Appreciate your input and any steps you take to avoid this.

2 Answers 2

0

The session token is probably stored in a cookie, yes. If an attacker can steal that cookie, they'll be able to access your account. However, there are multiple layers of protection against this happening:

  • Browser encryption of cookies at rest, using your platform's cryptographic keys (on MacOS / iOS, these are in the Keychain)
  • OS file system permissions preventing other users on the device from accessing the cookie file (though the Root user could bypass this)
  • Full-volume encryption preventing any data on the disk from being accessed even if the computer is stolen and its disk removed (e.g. File Vault on MacOS; this is optional, so make sure it's enabled!)
  • Secure flag on the cookie and HTTP Strict Transport Security on iCloud site prevents the cookie from being sent by the browser over insecure connections (supported in all major browsers)
  • Private / incognito mode causing cookies to not be saved to disk at all, and gone forever when the browser window closes (optional mode that the user can open the browser in; definitely do this any time you're using somebody else's device, and don't forget to close it afterward!)
  • HttpOnly flag on the cookie prevents the cookie from being accessed by scripts, even if somebody finds a way to inject one (XSS) into iCloud (optional, probably present but some chance it isn't; if iCloud has XSS vulnerabilities than attacks can do enormous damage even without stealing the cookie though)
  • Manually clearing cookies if you're worried that somebody else might access the computer (all browsers have a way to do it, and some can be configured to do it automatically every so often)
  • Maximum session lifetimes such that even if an attacker steals a cookie, the token it contains might have already expired or at least won't last long (this is site-specific; I don't know how long iCloud sessions last)
  • User ability to both log out their current session and to end any other active sessions if they suspect a session token might be compromised (this is also site-specific, but it's an important feature so hopefully iCloud has it)

That's a lot of protections! Some in the web app (iCloud), some in the browser, some in the OS or lower. Note that you, the user, need to have enabled some of these, and need to take action to cause some of the others to happen. Additionally, none of these are foolproof; for example, File Vault and Keychain both by default use your device login password, so an attacker who steals your laptop and knows your login password could potentially steal the cookie that way. Use strong passwords and don't let anybody see you enter them! Some platforms, such as Windows' BitLocker full volume encryption, optionally allow the user to require multi-factor authentication to decrypt the drive; I don't think File Vault has this feature though.

4
  • Thanks. I was concerned because it seems if you go to a library or borrow a friends computer that has malicious keylogger the secret keychain can be recovered easily. Is this true?
    – Nick
    Commented May 16 at 9:58
  • A library / internet cafe computer should wipe its browser storage after every user (and the users should make sure it does); there's common software or just browser settings for this. On a friend's computer, always use private/incognito (which does the same). Keylogger could still steal your password but wouldn't get your MFA credential. As a general rule, don't log into anything sensitive on somebody else's device... but if you do, MFA + erase the browser data afterward mostly mitigates the risks.
    – CBHacking
    Commented May 16 at 10:04
  • The browser could be compromised as well, not deleting the cookie or running in incognito/private. Is the MFA credential necessary to gain access to the user's keychain? My main concern was simply logging in like this to check calendar dates on a compromised computer could release access to Keychain credentials, which could be all your accounts. Not sure if this is true.
    – Nick
    Commented May 16 at 10:36
  • The browser (or operating system in general) being malicious or otherwise compromised is a "game over" scenario if you use it for anything sensitive (hence the "don't log into anything sensitive on somebody else's device" advice). MFA is not required to access the browser's local data storage (including keychain and similar), nor to use most secrets the browser might store (passwords being the only major exception); its only purpose is when creating a new authenticated session (or renewing/elevating one). Using a compromised browser has much bigger problems than "it might not delete cookies"!
    – CBHacking
    Commented May 17 at 18:42
0

While cookies can be stolen and sometimes used to impersonate an active user, there are several mitigations that can be used such as browser fingerprinting or verifying the IP address of the requests.

By far the best way to keep your account secure is to Log Out when you're done with your session. On a properly implemented system this will invalidate your session on the server side, so even if the cookie is stolen it it no longer works.

2 factor authentication is a great way to protect yourself on a public computer. The only real concern is that an attacker could use your account before you log off, or what you're doing during that session could be snooped on if the computer was compromised.

Edit: One last thing. These cookies are marked in a manner as such that the browser will only send them over a secure (TLS/HTTPS) connection so they aren't intercepted by monitoring the network.

1
  • Thanks. If "Find my iPhone" is used on another's device, one open's themselves up to a attack on their iCloud Keychain and iOS Cloud Backup. It would be more secure if Apple had a separate password for Find my iPhone, to protect us from this type of attack.
    – Nick
    Commented Oct 8, 2018 at 3:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .