Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?

My concern is, if logging into iCloud from someone else's device (or browser), this session cookie could be stored. A malicious person, perhaps unknown to the system owner, could grab the session cookie and username/password from logged keystrokes. Now this person has bypassed 2-factor authentication and can access:

iCloud Keychain, iCloud iOS Backup (with password attack) and much more iCloud data including calendar, contacts, notes, photos, etc...

It seems like a big risk because many people store website passwords, including passwords to encrypted backups (Time Machine), on the keychain. This type of attack could expose all of this.

Appreciate your input and any steps you take to avoid this.

1 Answer 1


While cookies can be stolen and sometimes used to impersonate an active user, there are several mitigations that can be used such as browser fingerprinting or verifying the IP address of the requests.

By far the best way to keep your account secure is to Log Out when you're done with your session. On a properly implemented system this will invalidate your session on the server side, so even if the cookie is stolen it it no longer works.

2 factor authentication is a great way to protect yourself on a public computer. The only real concern is that an attacker could use your account before you log off, or what you're doing during that session could be snooped on if the computer was compromised.

Edit: One last thing. These cookies are marked in a manner as such that the browser will only send them over a secure (TLS/HTTPS) connection so they aren't intercepted by monitoring the network.

  • Thanks. If "Find my iPhone" is used on another's device, one open's themselves up to a attack on their iCloud Keychain and iOS Cloud Backup. It would be more secure if Apple had a separate password for Find my iPhone, to protect us from this type of attack.
    – Nick
    Oct 8, 2018 at 3:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .