github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-06 07:48:22 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #610] [iOS] Vault unlocked after restoring from iCloud backup #6861

New Issue
Closed
opened 2026-04-10 23:13:08 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-10 23:13:08 -05:00
Owner
Copy Link

Originally created by @JamesMcMahon on GitHub (Sep 26, 2019).
Original GitHub issue: https://github.com/bitwarden/android/issues/610

I recently had to go through an 'Erase All Content and Setting' procedure with my iPad and then I restored the factory reset machine to an iCloud backup. After restoring I expected to have ro reenter my master password and 2FA but the vault was already unlocked and just required my fingerprint to open. The fingerprint, in this case, was newly configured during the setup process for my factory reset iPad.

Not sure this is a bug or expected behavior but it was a bit alarming to me so I figured I would report it. Is it possible for an attacker to restore an iCloud backup to a new device and get access to my vault?

Maybe a case of an encryption key being persisted like they are for Android. I just wanted to put this on your radar in case there was anything unintentional here.

Originally created by @JamesMcMahon on GitHub (Sep 26, 2019). Original GitHub issue: https://github.com/bitwarden/android/issues/610 I recently had to go through an 'Erase All Content and Setting' procedure with my iPad and then I restored the factory reset machine to an iCloud backup. After restoring I expected to have ro reenter my master password and 2FA but the vault was already unlocked and just required my fingerprint to open. The fingerprint, in this case, was newly configured during the setup process for my factory reset iPad. Not sure this is a bug or expected behavior but it was a bit alarming to me so I figured I would report it. Is it possible for an attacker to restore an iCloud backup to a new device and get access to my vault? Maybe a case of an encryption key being persisted [like they are for Android](https://github.com/bitwarden/mobile/issues/270). I just wanted to put this on your radar in case there was anything unintentional here.
GiteaMirror commented 2026-04-10 23:13:10 -05:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Sep 26, 2019):

This sounds expected since your encryption key is persisted in the iOS keychain, which survives an application reinstall. We can probably do some detection on fingerprint changes to require typing the master password again, but that doesn't change the fact that the key is still persisted.

<!-- gh-comment-id:535670294 --> @kspearrin commented on GitHub (Sep 26, 2019): This sounds expected since your encryption key is persisted in the iOS keychain, which survives an application reinstall. We can probably do some detection on fingerprint changes to require typing the master password again, but that doesn't change the fact that the key is still persisted.
GiteaMirror commented 2026-04-10 23:13:10 -05:00
Author
Owner
Copy Link

@JamesMcMahon commented on GitHub (Sep 27, 2019):

Is the encryption key my master password or something else?

Didn't realize anything was saved to Keychain but that is probably me being naive about iOS security. I assume you need to save that to Keychain to enable Touch Id?

<!-- gh-comment-id:535926006 --> @JamesMcMahon commented on GitHub (Sep 27, 2019): Is the encryption key my master password or something else? Didn't realize anything was saved to Keychain but that is probably me being naive about iOS security. I assume you need to save that to Keychain to enable Touch Id?
GiteaMirror commented 2026-04-10 23:13:10 -05:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Sep 27, 2019):

The master password is not persisted anywhere. Your encryption key is derived from your master password using PBKDF2.

Yes, to use Fingerprint we need to save the key.

<!-- gh-comment-id:535962970 --> @kspearrin commented on GitHub (Sep 27, 2019): The master password is not persisted anywhere. Your encryption key is derived from your master password using PBKDF2. Yes, to use Fingerprint we need to save the key.
GiteaMirror commented 2026-04-10 23:13:11 -05:00
Author
Owner
Copy Link

@JamesMcMahon commented on GitHub (Sep 27, 2019):

Makes sense to me. Thanks for your patience in explaining that.

Hopefully having it posted here will save you answering the same question again in the future.

<!-- gh-comment-id:536039116 --> @JamesMcMahon commented on GitHub (Sep 27, 2019): Makes sense to me. Thanks for your patience in explaining that. Hopefully having it posted here will save you answering the same question again in the future.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#6861
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?