News for hackers. Stuff that matters.
Re:APFS changes in Big Sur: how Time Machine backs up to APFS by DavidSJ on Monday September 28, 2020 @11:49PM (#24624001)
As a public service announcement, I recently discovered that, since OS X 10.9 Mavericks (released 2013), Time Machine's backup of keychains is completely broken for anyone who does not use iCloud Keychain. This bug is actually so completely unacceptable that it was hard for me to believe when I encountered it, but anyone can easily verify this for themself.

In particular, your account's Local Items keychain, which is used by Safari and some other Apple applications to store passwords, is encrypted in such a way that it can only be restored onto the exact same machine — knowing the user's password is insufficient. Thus, if your machine is lost, stolen, or damaged, a restore from Time Machine backup will not properly restore your keychain. Nor will the keychain properly migrate to another machine using Migration Assistant (luckily, this is how I discovered this behavior).

There is no warning of this behavior in any documentation, and no workaround whatsoever except to use a different browser or password manager, or to manually store all passwords yourself separately in the Login (rather than Local Items) keychain.

There's also no way to export the items in the the Local Items keychain except manually copying them to another keychain, during which you must enter your password one-by-one for each copied item (people have written some AppleScripts to automate this, e.g. https://gist.github.com/rmondello/b933231b1fcc83a7db0b).

If you use iCloud Keychain, then the Local Items keychain is just a machine-local cache of the iCloud data, which is fine, I guess. But this behavior is just dangerously broken if you do not use iCloud for this purpose.

Some more information on this issue:

https://forums.macrumors.com/threads/data-migration-local-ke...

https://apple.stackexchange.com/questions/142123/extract-pas...

https://apple.stackexchange.com/questions/137250/export-keyc...

https://forums.macrumors.com/threads/how-do-i-copy-the-local...

Re:APFS changes in Big Sur: how Time Machine backs up to APFS by ksec on Tuesday September 29, 2020 @03:52AM (#24625143)
So basically Time Capsule backup is useless if you want to buy a new Mac?

I now use the password generation and Keychain Password manager so much I dont even know any password of my online account.

How is that acceptable and not widely known?

Re:APFS changes in Big Sur: how Time Machine backs up to APFS by DavidSJ on Tuesday September 29, 2020 @04:23AM (#24625291)
It's not acceptable. I don't understand how it's not widely known, nor how it's gone seven years without a fix.

I wouldn't go so far as to say Time Machine/Time Capsule is useless, but it does have this severe sharp edge. So you need to have a plan for storing/migrating your passwords separately from the Local Items keychain.

Me, I took this as an excuse to switch to Firefox as my primary browser, and then I used one of those AppleScripts to migrate all my old passwords (thankfully, I still had my old computer).

Re:APFS changes in Big Sur: how Time Machine backs up to APFS by ksec on Tuesday September 29, 2020 @07:32AM (#24626386)
I think this needs to be made to HN front page or viral on twitter.

Along with iPhone iTunes Backup Corruption issues which is still not fixed. But it is hard to provide any evidence other than personal experience.

Re:APFS changes in Big Sur: how Time Machine backs up to APFS by DavidSJ on Tuesday September 29, 2020 @07:55AM (#24626566)
Re:APFS changes in Big Sur: how Time Machine backs up to APFS by Wowfunhappy on Tuesday September 29, 2020 @12:00PM (#24629422)
Fwiw, this bug must have been introduced more recently than Mavericks. I just tested moving my login keychain from one Mavericks computer to another Mavericks computer, and it worked fine. iCloud Keychain disabled on both machines.

Since many if those links are from when Yosemite was current, it wouldn’t surprise me if that was when the bug was introduced. Yosemite made a mess of things in a lot of ways, and Apple has never recovered.

Re:APFS changes in Big Sur: how Time Machine backs up to APFS by DavidSJ on Tuesday September 29, 2020 @05:01PM (#24632926)
The problem is not with the Login keychain, but the Local Items keychain.