Profile My skills Saved My plugins Edit profile Submit a skill

iOS Insecure Keychain Usage

Detects iOS Keychain items stored with insecure accessibility attributes that allow access when device is locked or without user authentication.

zakirkun Updated
Web & Frontend

File contents

iOS Insecure Keychain Usage

Overview

iOS Keychain stores sensitive data with different accessibility levels:

  • kSecAttrAccessibleAlways — accessible even when device is locked (insecure)
  • kSecAttrAccessibleWhenUnlocked — accessible only when device is unlocked (preferred)
  • kSecAttrAccessibleAfterFirstUnlock — accessible after first unlock (less secure)

Using kSecAttrAccessibleAlways means data can be read by malware or when device is physically stolen while locked.

Remediation

  • Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly for most sensitive items
  • Use kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly for highest security
  • Never use kSecAttrAccessibleAlways

zakirkun/ice-tea/tree/main/skills/mobile/ios/keychain-insecure commit c513104490

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/ios-insecure-keychain-usage