Hacker News Reader

Comment by js2 | Hacker News Reader

> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.)

Passkeys are stored in the iCloud Keychain which is end-to-end encrypted with 256-bit AES. Passkeys cannot be read by Apple anywhere but on your own device.

View on HN

Apple can install any software it wants up to the bootloader (iBoot) level on your iPhone via updates. So technically they can access your keys.

Yes. So do any OS/TPM vendors.

Unless you control/audit the whole stack (and forbid updates), you have to trust somebody.

You can reset your device using an IPSW you got off the internet if you want to make sure Apple isn't shipping targeted firmware to your device specifically.

I anticipated this reply which is why I added the qualifier "anywhere but on your own device." Unless you intend to manufacture your own device from scratch, at some point you have to place your trust somewhere. See "reflections on trusting trust":

https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/stati...

Does icloud e2e still have a loophole where apple can re-key it for you whenever they want? That's how it used to work, and as long as that's how it works their e2e is just for show.

So how does a new device join your iCloud and sync Keychain?

https://support.apple.com/en-gb/guide/security/sec0a319b35f/...

Reply on news.ycombinator.com