Questions tagged [keychain]

For security questions about Apple's Keychain Access app and the keychain file format on macOS and iOS

Filter by
Sorted by
Tagged with
2 votes
0 answers
74 views

Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?

Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything? With ...
user avatar
0 votes
0 answers
31 views

Is it a security risk that macOS Keychain.db files are accessible by any process on the system?

This question might have an obvious answer but I think a clear explanation is a missing piece on the internet. Isn't it (or is it) a security risk that macOS's Keychain.db files located at ~/Library/...
user avatar
0 votes
0 answers
242 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
user avatar
0 votes
0 answers
92 views

How secure are passwords, usernames and tokens stored in KeyChain (iOS 15)

As of iOS 15, users can pair their stored passwords with tokens. These are automatically populated by the OS via Safari on websites, when the user tries to login. That means, although the information ...
user avatar
  • 1
1 vote
0 answers
119 views

Storing cleartext password in iOS keychain

I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
user avatar
1 vote
0 answers
238 views

Export IOS Certificates and Configuration Profiles

Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
user avatar
2 votes
0 answers
453 views

iOS secure enclave and jailbreak

If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
user avatar
3 votes
1 answer
2k views

Why is GPG-agent still caching my passphrase?

I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including: default-cache-ttl 0 max-cache-ttl 0 (also flipped the bit to 1) within ~/.gnupg/gpg-agent.conf ...
user avatar
  • 151
7 votes
2 answers
823 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
user avatar
  • 123
2 votes
2 answers
381 views

What format is an decrypted RSA private key in, specifically in OS X Keychain?

I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
user avatar
  • 23
2 votes
1 answer
194 views

Why does not updating a MacOS keychain password cause applications to become troublesome? [closed]

I've changed my Macbook computer's password in using recovery mode. I'd changed it once normally, then it suddenly "stopped working" (or I started "mis-remembering" it after using it a few times, ...
user avatar
  • 1,385
0 votes
1 answer
515 views

Creating self-signed root CA using MacOS Keychain

I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that. For knowledge purpose, I'd like to create a Root, and ...
user avatar
  • 195
0 votes
1 answer
346 views

Stolen Google OAuth refresh token

I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account. Is the old OAuth ...
user avatar
5 votes
2 answers
1k views

Entropy on native memorable password on macosX keychain

I have been trying to find information on this. But I haven't found anything online. When you use the password manager on mac, it can provide "memorable" passwords. For example pick3"enigma. (You ...
user avatar
0 votes
0 answers
205 views

MacOS keychain encryption

There has been big media coverage that an application can just go and read the keychain without needing the master password, root access or anything. It just needs to be executed. But one thing I ...
user avatar
  • 394
1 vote
1 answer
412 views

what does "no value specified" default to in keychain on osx?

In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me ...
user avatar
1 vote
0 answers
455 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
user avatar
  • 11
1 vote
2 answers
855 views

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

I am trying to test the following setup: A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates: Client Public Key: ...
user avatar
3 votes
2 answers
6k views

Can OpenSSL verify a public key - intermediate CA certificate chain with a Root CA certificate?

I tried to run the following shell command: openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem where publickey_imcert_chain.cert is a chain of: servercert.pem (public key signed by ...
user avatar
0 votes
1 answer
525 views

Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app?

I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, ...
user avatar
  • 193
0 votes
2 answers
524 views

Is a password in keychain more secure than storing password in plaintext?

Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a ...
user avatar
4 votes
1 answer
582 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
user avatar
1 vote
1 answer
164 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
user avatar
5 votes
1 answer
1k views

Keychain-dumper and Secure Enclave

Is it possible to use keychain-dumper to extract private keys that are protected by the secure enclave? Keychain-dumper works with "/private/var/Keychains/keychain-2.db". If a private key is ...
user avatar
10 votes
1 answer
2k views

Secure Enclave and keychain security

I've read the WWDC 2015 article from Apple, which says that: We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around ...
user avatar
  • 201
7 votes
1 answer
9k views

Keychain vs KeyStore vs TrustStore

I'm quite confused between the three, and a Google search didn't come up with much. Can someone please explain?
user avatar
2 votes
2 answers
2k views

Hardware-backed Keychain for iOS and Android

I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/...
user avatar
2 votes
0 answers
7k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE CERT ...
user avatar
  • 161
3 votes
1 answer
691 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
user avatar
  • 131
2 votes
0 answers
474 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
user avatar
1 vote
1 answer
1k views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
user avatar
  • 163
2 votes
0 answers
129 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
user avatar
5 votes
1 answer
458 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
user avatar
2 votes
1 answer
248 views

Apple's Keychain - good security?

This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." ...
user avatar
4 votes
1 answer
619 views

KeyChain Access and GPG Keychain - should those be running simultaneously?

I have installed GPG Suite and found out also during this time that my OS X has some KeyChain Access app that stores all my passwords under my screenlock password - total news to me. Can I get rid of ...
user avatar
4 votes
0 answers
2k views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
user avatar
  • 153
1 vote
1 answer
380 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to encrypt/...
user avatar
0 votes
1 answer
236 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
user avatar
  • 1,884
12 votes
3 answers
10k views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
user avatar
  • 1,884
1 vote
1 answer
485 views

Can any malware access the OSX keychain data

I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...
user avatar
  • 111
7 votes
4 answers
3k views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
user avatar
  • 79
0 votes
3 answers
2k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
user avatar
  • 135
3 votes
1 answer
908 views

How is the iOS KeyChain master key derived?

I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect. On iOS there is no user account password, only a ...
user avatar
  • 225
9 votes
4 answers
1k views

How secure is OS X's Keychain access control?

On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access. Supposedly, the system saves not only the binary path, but also its hash in ...
user avatar
  • 4,054