Keys are saved as part of iCloud backup

[4ad]

What did you do?

1. Install Authenticator on iOS
2. Set-up keys
3. Reset iOS device and restore from iCloud backup

What did you expect to see?

1. No keys, per the documentation:

and your secret keys never leave your device

What did you see instead?

1. Keys are set-up in Authenticator

System configuration

Default iOS configuration with iCloud backup and iCloud Keychain enabled.

Additional notes

I realize that the backups are encrypted, but this is certainly is not the behavior I expect. In fact, I chose this app precisely because I thought it didn't do this. I am not sure if the application state persists because of the iOS backup, or if it's saved by the iCloud Keychain.

Also something seems wrong here because in other issues people want some kind of sync/backup/restore functionality, but that functionality seems to be present already.

[beaucollins]

I realize that the backups are encrypted, but this is certainly is not the behavior I expect. In fact, I chose this app precisely because I thought it didn't do this. I am not sure if the application state persists because of the iOS backup, or if it's saved by the iCloud Keychain.

Also something seems wrong here because in other issues people want some kind of sync/backup/restore functionality, but that functionality seems to be present already.

I'm in the same boat. I chose this app because I didn't want any kind of backup or syncing of my keys.

The technical details are that Authenticator uses OneTimePassword. When using SecItemAdd and SecItemUpdate these are the keychain attributes it uses:

https://github.com/mattrubin/OneTimePassword/blob/b8e8b7ed5493fb534be61b57d0151ad23329ed36/Sources/Keychain.swift#L122-L126

        return [
            kSecAttrGeneric as String:  data as NSData,
            kSecValueData as String:    generator.secret as NSData,
            kSecAttrService as String:  kOTPService as NSString,
        ]

The only thing I know of that tells these keychain items "sync" with iCloud is to use kSecAttrSynchronizable, which it very much does not nor has ever used.

I'll see what I can do to reproduce this. I currently only have one iOS device.

If I were to guess as to what's going on I would say an update to iOS has introduced additional backup features.

[mattrubin]

The keychain API attribute usage in OneTimePassword was intended specifically to allow token secret keys to be backed up in an encrypted local backup, but not to be backed up in an (unencrypted) iCloud backup. At the time it was implemented, this was the default behavior for Keychain items saved without any special sync-related attributes.

I heard a passing mention a while back that Apple was starting to include saved keychain items in iCloud backups, whereas previously all keychain items had been excluded from iCloud backups. I tested this behavior (both months ago and again recently), and an iCloud backup restore did not restore saved tokens – but I'm realizing now that the iCloud account I tested this on did not have iCloud Keychain turned on.

Based on @4ad'a report, my hypothesis is that:

• keychain items marked for sync are synced via iCloud Keychain, regardless of the use of iCloud backup.
• for accounts with iCloud Keychain turned on, keychain items not marked for sync will not be included in iCloud backups.
• at some point, Apple integrated iCloud backup and iCloud Keychain such that iCloud Keychain will be used to backup non-synced passwords that are present on devices being backed up to iCloud.

This is just a hypothesis at this point. I have a spare iOS device on hand and will try to test this, though due to other commitments the earliest I can carve out time for that testing may be next week. Thank you @4ad for the clear bug report, and thank you @beaucollins for following up with more info!

[G-eos]

Hi, I am using today Google Auhtenticator and my concern is that all service with 2FTA will not be accessible if I lost my phone :) because not backup is done. Thus I am searching a way to backup those keys somewhere (but in a controled place :)). But in iCloud ... this is not my favorite place :)
Please do you think to fix this issue or not ? (An advice on how do you backup yours will be appreciated).

[G-eos]

After more read -> Backup if the backup is encrypted :)

[ghost]

@mattrubin

The keychain API attribute usage in OneTimePassword was intended specifically to allow token secret keys to be backed up in an encrypted local backup, but not to be backed up in an (unencrypted) iCloud backup. At the time it was implemented, this was the default behavior for Keychain items saved without any special sync-related attributes.

I heard a passing mention a while back that Apple was starting to include saved keychain items in iCloud backups, whereas previously all keychain items had been excluded from iCloud backups. I tested this behavior (both months ago and again recently), and an iCloud backup restore did not restore saved tokens – but I'm realizing now that the iCloud account I tested this on did not have iCloud Keychain turned on.

Based on @4ad'a report, my hypothesis is that:

• keychain items marked for sync are synced via iCloud Keychain, regardless of the use of iCloud backup.
• for accounts with iCloud Keychain turned on, keychain items not marked for sync will not be included in iCloud backups.
• at some point, Apple integrated iCloud backup and iCloud Keychain such that iCloud Keychain will be used to backup non-synced passwords that are present on devices being backed up to iCloud.

This is just a hypothesis at this point. I have a spare iOS device on hand and will try to test this, though due to other commitments the earliest I can carve out time for that testing may be next week. Thank you @4ad for the clear bug report, and thank you @beaucollins for following up with more info!

Did you ever get around to testing this? I only have one iOS device and would like to know if I have to manually do an encrypted backup to my computer or if I can rely on iOS keychain iCloud backups to backup all of my codes for me, also how do I see where they would be marked for sync so I know if they're getting backed up to the cloud? I would test to see but sadly I am limited to one iOS device! Thanks.

[beaucollins]

@bluepaww I would recommend making a secure backup before trying anything.

However, I have restored two different devices, mine and a family members, and both of them had their two-factor codes restored from iCloud.

In both cases iCloud keychain was configured and active for the relevant iCloud accounts.

[daveewart]

I realise this is only a related question, but it does seem relevant to the issue described here and I can't find an answer anywhere else.

With regard to the standard "migrating from old iPhone to new iPhone" procedure as per https://support.apple.com/en-gb/HT210216 -- is the expected behaviour that Authenticator secrets would be migrated successfully from the old to new device, or not?