WORLDTECHiOS flags saved passwords that appear in data leaks, Engadget reports
Apple's iOS can warn users when a password saved in the Passwords app appears in a data leak, according to a report from Engadget. The alert does not on its own mean that an account has been broken into, but it signals that a login needs attention.
How the warning reaches users
The free Passwords app stores logins and passkeys and syncs them through iCloud Keychain, which uses end-to-end encryption. Engadget reports that iOS compares the passwords kept in that app with leaked password data, and it does so even when the website concerned has not reported a breach.
Users who receive a warning can review the flagged accounts in the Passwords app, so the alert is not a one-off notification that disappears once dismissed.
Checks that avoid sending passwords
Engadget describes two layers of checking. Your iPhone first compares saved credentials with a local list of commonly leaked passwords. Passwords not on that list are checked using privacy-preserving cryptographic exchanges with Apple's servers, in which the phone sends information derived from the password rather than the password itself.
Apple says it does not keep that information either. The warning, however, does not specify where a password was leaked, which leaves users without a source to investigate.
Limits of the alert
Engadget stresses that a flagged password is not proof of intrusion. Weak or leaked passwords are reported so that users can decide which logins to change, and Windows users can reach the same saved passwords through Chrome or Edge after setting up iCloud for Windows and the browser extension, while Android has no native iCloud Passwords app.
Open questions
- Which leaks the flagged passwords come from remains unknown, because Apple's warning does not name a source?