Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors.
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
As far as I know, you have never been able to import or export keys from the Secure Enclave. It’s more likely that previously keys were stored in the keychain and now they are generated in the SE by default.
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
It's always a good idea to plan to hang on to your old machine for a few weeks to ensure everything works properly on the new one. Apple makes that much easier to forget.
And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
that seems reasonable, as it is the lowest common denominator for interoperability
what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't able to use their own property to export their own passwords in a different format.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s).
> if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it.
You can export your passwords to a plain text CSV from the original computer.
Hardware keys are the way:
- Less likely to fail in the first place
- Cheap enough to have several of so you can use one to log in and manage the others in the event of loss
- Easy to move between devices
- Less likely to use the auth handshake as a side channel for things you didn't consent to
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
No, it's not, and that's not how it ever worked in macOS 26.3 and earlier.
This change was introduced in 26.4 for some reason.
Yes
> in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
Apparently not
what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't able to use their own property to export their own passwords in a different format.