Secrets are stored in iCloud Keychain

[jeroenleenarts]

I think the secrets are stored on iCloud. But that the secrets are just not visible on other devices due to the identifier list stored on user defaults.

I might be wrong. But worth checking out since you clearly indicate not storing stuff outside of the app. I base this on not seeing a “this device” only flag in this repo or the otp component one.

[jeroenleenarts]

Double checked. Not seeing any option being passed with the keychain attribute dict like ‘ kSecAttrAccessibleWhenUnlockedThisDeviceOnly’

[jeroenleenarts]

I read up a bit on Cloud KeyChain
kSecAttrSynchronizable is not used, so items are not sync-able.

[beaucollins]

#6 #309 are related

Also worth noting iCloud has restored my tokens ever since having two-factor and iCloud keychain

#330 (comment)