It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue.
IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
I have no idea which keychain is in which, but the last time I migrated from one Apple laptop to another, I couldn't get the automated tool to work at all, so I restored a physical backup, went through the sign-in process, and passwords and passkeys migrated correctly.
I tested restoring my restic backups to the same PC and it worked. If I was forced to use a mac and Apple's password manager, I'd probably do the same test, conclude it worked, and then later lose all my data. If you care about keeping your data, there's no substitute for understand how things work.
This is so critical. Not just verifying the hashes, not just restoring, but actually booting into it and opening the top 5-10 things you're going to care about.
If it's your personal stuff, skip it at your own peril. If it's a paid responsibility, that's what hourly billing is for (this incentive was much stronger when I learned netadmin, back before nvmes)
It's unreasonable to ask everyone to own a second computer just to test restoring backups on, and it sounds like doing the test on the same computer wouldn't have caught this problem.
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
Recently tried to initialize one Mac from another - kids, never ever attempt that! Microsoft stuff doesn't get copied over properly, and refuses to behave even if you delete an account and create a new one - the only solution is re-installing the OS from scratch. And if you want to do so, and you erase the disk - surprise surprise, in recovery mode macOS doesn't work with the WPA2/WPA3 Enterprise network; you need to go and find a WPA2 network somewhere to re-install the OS. Does the recovery menu explain that somewhere? Hell no. Damn, installing a linux distro from a usb stick is a better experience than re-installing macOS these days!
Switching from macOS to Linux was quite painful because the security was so seamless on Mac. But I also realized I had no idea how my passwords are stored and under what guarantees. Learning and getting the hardware tokens to do it properly on Linux was a PITA. But reading this post made me feel a pinch better.
It sounds like they are using envelope encryption and using the Secure Enclave to derive the row keys each time. Not really any easy way around that except they should provide a tool to export it, TBH. I am guessing they weren’t using envelope encryption before or they were deriving the row keys from the password. This is a secure design but more security usually means less usability these days.
It's always a good idea to plan to hang on to your old machine for a few weeks to ensure everything works properly on the new one. Apple makes that much easier to forget.
And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
that seems reasonable, as it is the lowest common denominator for interoperability
what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't able to use their own property to export their own passwords in a different format.
This is pretty much how it's suppose to work...
Maybe but this is unexpected if you need to restore from a backup..
It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
12 replies →
I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.
7 replies →
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue.
Use iCloud Keychain or don't use Keychain at all.
2 replies →
Don't backup keys, rotate them.
5 replies →
I'm more interested by the fact that it apparently didn't work this way before Tahoe.
IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
3 replies →
> This is pretty much how it's suppose to work...
No, it's not, and that's not how it ever worked in macOS 26.3 and earlier.
This change was introduced in 26.4 for some reason.
Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
The iCloud keychain is separate from the login keychain. The Passwords app doesn't use the login keychain.
I have no idea which keychain is in which, but the last time I migrated from one Apple laptop to another, I couldn't get the automated tool to work at all, so I restored a physical backup, went through the sign-in process, and passwords and passkeys migrated correctly.
1 reply →
Even more confusing. Do we know which data is in which keychain?
1 reply →
> Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
Randomly, Chromium-based browser profiles can't perfectly copy across macOS machines either, because of some HMAC hashing that happens to extensions.
You don't have any backups at all if you never tried restoring and testing them
I tested restoring my restic backups to the same PC and it worked. If I was forced to use a mac and Apple's password manager, I'd probably do the same test, conclude it worked, and then later lose all my data. If you care about keeping your data, there's no substitute for understand how things work.
This is so critical. Not just verifying the hashes, not just restoring, but actually booting into it and opening the top 5-10 things you're going to care about.
If it's your personal stuff, skip it at your own peril. If it's a paid responsibility, that's what hourly billing is for (this incentive was much stronger when I learned netadmin, back before nvmes)
It's unreasonable to ask everyone to own a second computer just to test restoring backups on, and it sounds like doing the test on the same computer wouldn't have caught this problem.
1 reply →
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
Does the macoOS login keychain get backed up by Time Machine backups
Yes
> in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
Apparently not
"Apparently"? Is this something that can be tested with VMs?
1 reply →
Recently tried to initialize one Mac from another - kids, never ever attempt that! Microsoft stuff doesn't get copied over properly, and refuses to behave even if you delete an account and create a new one - the only solution is re-installing the OS from scratch. And if you want to do so, and you erase the disk - surprise surprise, in recovery mode macOS doesn't work with the WPA2/WPA3 Enterprise network; you need to go and find a WPA2 network somewhere to re-install the OS. Does the recovery menu explain that somewhere? Hell no. Damn, installing a linux distro from a usb stick is a better experience than re-installing macOS these days!
Switching from macOS to Linux was quite painful because the security was so seamless on Mac. But I also realized I had no idea how my passwords are stored and under what guarantees. Learning and getting the hardware tokens to do it properly on Linux was a PITA. But reading this post made me feel a pinch better.
Documentation explaining the Keychain security model: https://support.apple.com/en-gb/guide/security/secb0694df1a/...
This was introduced, unannounced, in macOS 26.4! See my blog post for more information: https://lapcatsoftware.com/articles/2026/9/4.html
It sounds like they are using envelope encryption and using the Secure Enclave to derive the row keys each time. Not really any easy way around that except they should provide a tool to export it, TBH. I am guessing they weren’t using envelope encryption before or they were deriving the row keys from the password. This is a secure design but more security usually means less usability these days.
It's always a good idea to plan to hang on to your old machine for a few weeks to ensure everything works properly on the new one. Apple makes that much easier to forget.
And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
that seems reasonable, as it is the lowest common denominator for interoperability
what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't able to use their own property to export their own passwords in a different format.
It's not reasonable to settle on the lowest common denominator as the only denominator
This is good.