iCloud Security Concern: browser session authentication storage after 2-factor?

Question

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?

My concern is, if logging into iCloud from someone else's device (or browser), this session cookie could be stored. A malicious person, perhaps unknown to the system owner, could grab the session cookie and username/password from logged keystrokes. Now this person has bypassed 2-factor authentication and can access:

iCloud Keychain, iCloud iOS Backup (with password attack) and much more iCloud data including calendar, contacts, notes, photos, etc...

It seems like a big risk because many people store website passwords, including passwords to encrypted backups (Time Machine), on the keychain. This type of attack could expose all of this.

Appreciate your input and any steps you take to avoid this.

Answer 1

While cookies can be stolen and sometimes used to impersonate an active user, there are several mitigations that can be used such as browser fingerprinting or verifying the IP address of the requests.

By far the best way to keep your account secure is to Log Out when you're done with your session. On a properly implemented system this will invalidate your session on the server side, so even if the cookie is stolen it it no longer works.

2 factor authentication is a great way to protect yourself on a public computer. The only real concern is that an attacker could use your account before you log off, or what you're doing during that session could be snooped on if the computer was compromised.

Edit: One last thing. These cookies are marked in a manner as such that the browser will only send them over a secure (TLS/HTTPS) connection so they aren't intercepted by monitoring the network.