-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
aolvera Feb 9, 2017 1:42 PM (in response to DustMan)I'm also experiencing this behavior.
My code hasn't changed and it works in other iOS versions.
It's only in 10.3 that my data seems to be gone after uninstalling the app. -
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Wallisch Feb 13, 2017 5:32 AM (in response to DustMan)I can confirm this new behaviour.
Seems like the last way to "identify" a device is gone now.
While i'm fine with iOS purging an uninstalled apps keychain content by default (keep it clean), there should be an option for keys to be persistent.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
koogawa Feb 21, 2017 12:33 AM (in response to DustMan)Not fixed for my Xcode 8.3 beta 3 / iOS 10.3 beta 3 (iPhone 7)
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
mcknut Feb 21, 2017 1:23 AM (in response to DustMan)Have you (or anyone here) tried turning Keychain Sharing on for your app, does that help the data to persist? If you're sharing your data with more than one of your own apps you would hope it would persist, but then it might get deleted once all of your apps are deleted. Would be interesting to try out if you have a simple test case available.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
CGRekt Feb 21, 2017 10:25 AM (in response to DustMan)I am only able to reproduce this issue in 10.3 beta 2 and 3 (didn't try 1) if I have "App Groups" disabled. If I simply have the "App Groups" capability set to "ON" (even with none of the App Groups selected), the keychain data will still persist between deleting and reinstalling the application. I am curious to know if this is working for others.
I don't even need to write the key to the a shared access group or have "Keychain Sharing" enabled to get the data to persist after delete. I hope this helps and I do agree with other posters that a fully supported persistence option is needed.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Razven Feb 21, 2017 11:47 AM (in response to CGRekt)I am seeing the same behaviour which you mentioned. Simply switching the capability on makes the keychain data persist. Thanks for sharing.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
bunnyhero Feb 23, 2017 2:51 PM (in response to Razven)On 10.3 beta 3, having "App Groups" ON does not persist the keychain data for me on my test device (iPhone 5), but it does on the Simulator. What have others tested on? Thank you.
-
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Razven Feb 21, 2017 11:43 AM (in response to DustMan)Another potential workaround is to use the kSecAttrAccessGroupToken access group constant which was added in iOS 10.
Here is the documentation for it:
/*! @enum kSecAttrAccessGroup Value Constants @constant kSecAttrAccessGroupToken Represents well-known access group which contains items provided by external token (typically smart card). This may be used as a value for kSecAttrAccessGroup attribute. Every application has access to this access group so it is not needed to explicitly list it in keychain-access-groups entitlement, but application must explicitly state this access group in keychain queries in order to be able to access items from external tokens. */
After testing with iOS 10.3 beta2, keychain items saved to that access group persist beyond app uninstall.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Zevik Feb 28, 2017 5:50 AM (in response to Razven)Hi,
When i using the kSecAttrAccessGroupToken the keychain is accesible from other application.
Is this the desired behaviour from Apple ?
Does someone have better documentation on this topic besides the empty API https://developer.apple.com/reference/security/ksecattraccessgrouptoken kSecAttrAccessGroupToken ?
Thanks !
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Razven Feb 28, 2017 6:58 AM (in response to Zevik)Hey,
Judging from this line in their documentation:
"Every application has access to this access group"
I would say that is the desired behaviour.
I have been trying to figure out ways to securely encrypt/decrypt things placed in that access group such that other apps cannot interpret the data stored there. Please let me know if anyone has any ideas for how to achieve this.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
gc. Apr 20, 2017 10:38 AM (in response to Zevik)1 of 1 people found this helpfulHi Zevik,
This is a bug in the beta that should already be fixed by the time you read this.
kSecAttrAccessGroupToken is writable only by CryptoTokenKit smart card drivers. Apps can query the keychain using that attribute in order to find items stored on a particular smart card. This attribute is not for any other use.
--gc
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
yip chee wah Feb 28, 2017 7:05 AM (in response to Razven)me too
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Razven Feb 28, 2017 7:27 AM (in response to DustMan)Another interesting side effect of this is that iCloud keychain items seem to get cleared on app deletion also.
In the case where an app is installed on multiple devices logged in with the same iCloud account, any keychain items which were stored in iCloud from either of the apps on the various devices will get cleared when any one of the apps is deleted, even if the others are left in tact on another device.
To me this feels like it is unintentional. It would be nice if someone from Apple could chime in to clarify some of the intended changes to the keychain.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
gc. Feb 28, 2017 10:38 AM (in response to DustMan)This is an intentional change in iOS 10.3 to protect user privacy. Information that can identify a user should not be left on the device after the app that created it has been removed.
It has never been a part of the API contract that keychain items created by an app would survive when the app is removed. This has always been an implementation detail.
If a keychain item is shared with other apps, it won't be deleted until those other apps have been deleted as well.
There is documentation in the works about this change that should address questions raised in this thread.
--gc
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Razven Feb 28, 2017 11:16 AM (in response to gc.)Thanks for the clarification, gc.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
MrRooni Mar 10, 2017 3:49 PM (in response to gc.)Hello gc,
Thanks for responding here. There is a serious data loss issue with the current implementation. I've filed it as rdar://30983606 - Deleting an app deletes keychain items stored in the iCloud Keychain.
All the best,
Michael Fey
AgileBits, makers of 1Password
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Smallmedium Mar 17, 2017 1:20 PM (in response to gc.)Like others, we found that keychain persitence after app removal is still ocurring on iOS 10.3 beta 7. As Apple typically provides more frequent beta updates approaching the GM and that appears to be occuring now does this mean that keychain persistence will still be possible on the final GM?
We're already working on an alternate solution to provide the features our users will need, but it will be good to be informed of Apple's plans since these changes are quite costly, and even if the change will be imminent but simply postponed then we could schedule our work accordingly. You also mentioned that some documentation was in the works, and I hope you might update this thread with that once it's available.
Thank you gc.!
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
ants Mar 21, 2017 12:00 AM (in response to gc.)kSecAttrAccessGroupToken – A workaround for the keychain autodelete behaviour found in iOS 10.3
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
af-fess Mar 7, 2017 4:13 AM (in response to DustMan)I'm not able to reproduce this behavior.
I use Version 8.3 beta 3 (8W132p)
Tested on device 5c:
iOS 10.3 beta 2
iOS 10.3 beta 4
Simulators:
iOS SE
iOS 7 Plus
'App Groups' - disabled
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
marcwand Mar 7, 2017 9:17 AM (in response to af-fess)As others have mentioned above, this doesn't repro in the simulator, but _does_ on devices. Beta4 seems unchanged from Beta3 from what I can see on the 5C I've been playing around with.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
af-fess Mar 8, 2017 7:00 AM (in response to marcwand)yes, cannot reproduce on real device as well (5c iOS 10.3 beta 4)
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
uerceg Mar 8, 2017 7:59 AM (in response to af-fess)In my case: iOS 10.3 beta 3 and iOS 10.3 beta 4 on iPhone 6S and iPhone 6S Plus - confirmed and able to reproduce.
-
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
shougayugokugoku Mar 13, 2017 3:53 AM (in response to af-fess)I have reproduction Apps and Non-reproduction Apps.
But, I don't know the reason for the difference.
*Confirmed with Non-reproduction App
- I'm using real device (iPhone 5 / iOS 10.3 beta 4, 5).
- Keychain is autodeleted if it is an App of Development or AdHoc.
- Keychain is NOT autodeleted if it is an App of AppStore.
- The App does not use "App Groups".
- All Apps in the same "Access Group" are uninstalled.
I'm wondering why the keychain is not deleted. (And it is strange that keychain will be deleted in the case of 2)
So, I want to know why the difference is occurring.
(Are there elements other than "App Groups" and "Access Group" to avoid deleting keychain? And does it only work for App Store apps?...)
Thanks,
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
shougayugokugoku Mar 14, 2017 4:23 AM (in response to shougayugokugoku)When I tried with iOS 10.3 beta 6, keychain data is not deleted.
(When trying the App with iOS 10.3 beta 5, the keychain data was deleted.)
What is the final specification of the keychain in iOS 10.3?
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Rozzle Mar 15, 2017 11:13 AM (in response to shougayugokugoku)I'm seeing the same behaviour. Beta 6 does not seem to clear the keychain on app delete.
-
-
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
huin Mar 15, 2017 3:29 AM (in response to DustMan)I tried this behavior, but I couldn't reproduce it.
My test environment is below:
- OS: iOS 10.3 beta 6
- Device: iPhone 6s
- Xcode : 8.3 beta 4
- SDK: iOS 10.3 SDK
- Capabilities: Disabled App Groups, Keychain Sharing
- Configuration : Debug
How can I reproduce it?
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Rozzle Mar 15, 2017 5:55 PM (in response to huin)The behaviour seems to have been put back to normal in beta6. Try it with beta2, 3, 4, or 5
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
huin Mar 16, 2017 8:19 PM (in response to Rozzle)Rozzle
Thank you for your reply.
I tried again under iOS 10.3 beta 7 (14E5277a) device with both of Development and AppStore(TestFlight) build, but I couldn't reproduce it.
I hope this change will not include in public release.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
shougayugokugoku Mar 16, 2017 10:18 PM (in response to huin)Hello huin,
I also confirmed that this issue does not reproduce with iOS 10.3 beta 7.
>I hope this change will not include in public release.
I feel the same.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
Rozzle Mar 27, 2017 2:28 PM (in response to shougayugokugoku)10.3 was released publicly today and it seems the behaviour experienced in the betas is not reflected in the public version. In my testing, keychain items continue to persist beyond app delete.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
zhq Mar 27, 2017 7:16 PM (in response to Rozzle)Thanks for testing
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
huin Mar 27, 2017 7:20 PM (in response to Rozzle)Rozzle
Thans for your information.
-
Re: iOS 10.3 Beta 2 autodeletes keychain items after application uninstall?
shougayugokugoku Mar 27, 2017 9:40 PM (in response to Rozzle)Rozzle
Thanks for testing.
I also confirmed the same result.
-
-
-
-
-