Questions tagged [keychain]
For security questions about Apple's Keychain Access app and the keychain file format on macOS and iOS
47
questions
0
votes
1
answer
56
views
Keychain iOS: info on other users
I am analyzing an iOS mobile application. I discovered that the app saves all logged-in users in the keychain, specifically saving their first name, last name, email, and id_token. This id_token, ...
- 127
0
votes
0
answers
92
views
Storing APFS password in Apple's Keychain for Time Machine
If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
- 203
2
votes
0
answers
189
views
Storing encrypted data in iOS keychain
In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
- 133
3
votes
1
answer
2k
views
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
- 56
1
vote
0
answers
116
views
Password generation algorithm used by MacOS keychain
What algorithm does MacOS use in its keychain system to generate passwords? (using password assistant accessed through keychain app and using Safari keychain).
Does it access/is it the GUI for the /...
- 11
5
votes
1
answer
595
views
Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?
Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything?
With ...
- 179
0
votes
0
answers
1k
views
Storing a private key in android/ios keychain encrypted or not
In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common)
I am facing questions regarding how to store my user's private key on the device. I am to use a ...
- 101
1
vote
0
answers
240
views
Storing cleartext password in iOS keychain
I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
1
vote
0
answers
578
views
Export IOS Certificates and Configuration Profiles
Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
- 11
3
votes
0
answers
612
views
iOS secure enclave and jailbreak
If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
4
votes
1
answer
2k
views
Why is GPG-agent still caching my passphrase?
I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including:
default-cache-ttl 0
max-cache-ttl 0
(also flipped the bit to 1)
within ~/.gnupg/gpg-agent.conf ...
- 171
7
votes
2
answers
988
views
Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?
Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server?
Sign up
The client provides an email and password and saves the clear password on ...
- 123
2
votes
2
answers
713
views
What format is an decrypted RSA private key in, specifically in OS X Keychain?
I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
- 23
2
votes
1
answer
261
views
Why does not updating a MacOS keychain password cause applications to become troublesome? [closed]
I've changed my Macbook computer's password in using recovery mode. I'd changed it once normally, then it suddenly "stopped working" (or I started "mis-remembering" it after using it a few times, ...
- 1,409
0
votes
1
answer
649
views
Creating self-signed root CA using MacOS Keychain
I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that.
For knowledge purpose, I'd like to create a Root, and ...
- 195
0
votes
1
answer
420
views
Stolen Google OAuth refresh token
I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account.
Is the old OAuth ...
user156092
5
votes
2
answers
1k
views
Entropy on native memorable password on macosX keychain
I have been trying to find information on this. But I haven't found anything online.
When you use the password manager on mac, it can provide "memorable" passwords.
For example pick3"enigma. (You ...
- 103
0
votes
0
answers
247
views
MacOS keychain encryption
There has been big media coverage that an application can just go and read the keychain without needing the master password, root access or anything. It just needs to be executed.
But one thing I ...
- 394
1
vote
1
answer
675
views
what does "no value specified" default to in keychain on osx?
In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me ...
- 271
1
vote
0
answers
575
views
Is access token saved in Cache.db-wal bad for iOS app?
tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
- 11
1
vote
2
answers
1k
views
Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?
I am trying to test the following setup:
A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates:
Client
Public Key: ...
3
votes
2
answers
7k
views
Can OpenSSL verify a public key - intermediate CA certificate chain with a Root CA certificate?
I tried to run the following shell command:
openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem
where publickey_imcert_chain.cert is a chain of:
servercert.pem (public key signed by ...
0
votes
1
answer
601
views
Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app?
I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, ...
- 223
0
votes
2
answers
621
views
Is a password in keychain more secure than storing password in plaintext?
Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a ...
- 103
4
votes
1
answer
648
views
Using a gmail oath2 token to access web email
I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
- 51
1
vote
1
answer
194
views
Know LastPass fishing apps? Ways to protect?
I am a LastPass user, which I use with the browser extensions.
Lately it occurred to me that it should not be too hard to create a fishing browser extension that
would replace LastPass upon install,...
- 13
6
votes
1
answer
1k
views
Keychain-dumper and Secure Enclave
Is it possible to use keychain-dumper to extract private keys that are protected by the secure enclave?
Keychain-dumper works with "/private/var/Keychains/keychain-2.db". If a private key is ...
- 441
12
votes
1
answer
2k
views
Secure Enclave and keychain security
I've read the WWDC 2015 article from Apple, which says that:
We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around ...
- 221
8
votes
1
answer
10k
views
Keychain vs KeyStore vs TrustStore
I'm quite confused between the three, and a Google search didn't come up with much. Can someone please explain?
- 441
3
votes
3
answers
3k
views
Hardware-backed Keychain for iOS and Android
I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/...
- 441
2
votes
0
answers
7k
views
SSL self signed certificate CER exception added to Keychain but fails in Chrome
Operating System: Mac OSX El Capitan 10.11.5
When browsing to the page I have a Privacy error, although an exception was added.
I have the correct CER file so I added it to my Keychain
TRUST THE CERT ...
- 161
3
votes
1
answer
728
views
Storage of account password on keychain iOS to enable TouchID login
Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice?
The ...
- 131
3
votes
0
answers
527
views
iOS keychain - who or what can access it
I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
- 213
1
vote
1
answer
1k
views
How to determine effective trust chain for cert on MacOS X?
I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here.
I ...
- 165
2
votes
0
answers
158
views
Under what conditions does Safari have access to the Keychain?
The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data.
People who use iCloud, and also enable the keychain synchronization ...
- 51k
5
votes
1
answer
491
views
How to encrypt data using the iOS secure element?
I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
- 83
2
votes
1
answer
309
views
Apple's Keychain - good security?
This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." ...
user87589
4
votes
1
answer
788
views
KeyChain Access and GPG Keychain - should those be running simultaneously?
I have installed GPG Suite and found out also during this time that my OS X has some KeyChain Access app that stores all my passwords under my screenlock password - total news to me. Can I get rid of ...
user87589
4
votes
0
answers
2k
views
Security flaw in iOS, Safari weird behavior or what else?
some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x).
...
- 153
1
vote
1
answer
414
views
Private messages for an ios app - how secure is this system?
I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message).
Client side - iOS, server side - Parse.com
I'm thinking of using RSA to encrypt/...
- 111
0
votes
1
answer
263
views
Can any App Store app access all of my passwords?
Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
- 1,984
14
votes
3
answers
11k
views
Export non-extractable private key from Keychain on OS X
I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key.
The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
- 1,984
1
vote
1
answer
524
views
Can any malware access the OSX keychain data
I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...
- 111
7
votes
4
answers
3k
views
Method to integrate Touch ID in iOS apps
With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
- 79
0
votes
3
answers
2k
views
How secure is iOS Touch ID?
I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
- 135
3
votes
1
answer
986
views
How is the iOS KeyChain master key derived?
I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect.
On iOS there is no user account password, only a ...
- 225
9
votes
4
answers
1k
views
How secure is OS X's Keychain access control?
On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access.
Supposedly, the system saves not only the binary path, but also its hash in ...
- 4,273