Appears that iCloud shared my Safari passwords with my child's Apple ID on their tablet.

[applehead50]

Up front, I'm working this closely with Apple right now and we're working to try to sort out the issue. Problem is the tablet is in a remote physical location and I don't have access to troubleshoot. I'm going to try to recreate this issue with my personal tablet. I'm posting here for awareness and help to try to figure out what I did (or is this a security flaw).

Months back, I upgraded to an iPad Pro 10 inch. I followed the exact steps for preparing an iPad for sale (removed Find my iPhone, erased everything) and a few months later I decided to give that tablet to my child.

I created an Apple ID under family sharing and set up the iPad with that Apple ID. Looking at my e-mail records, I see the e-mail notification from my child's family ID when I logged in to the device. From that point forward, it was the only ID signed on to that device according to my memory and my e-mail records.

Fast forward to now, where I was notified and received proof that my Safari saved passwords showed up on my child's device.

My only family sharing setting turned on was App Purchases. I never logged into that device with my ID (that I can prove at this point with my memory and e-mail records).

On the surface, it seems to me that the device (and that AppleID) some how picked up old data from my tablet (sounds impossible) or sucked in my data (possible?).

My child does not have iCloud set up on that account, I just tried logging into that account on iCloud and it asked me to set up iCloud. Is it possible my child's account pulled from my iCloud information instead?

 

[chabig]

Keychain info isn’t part of family sharing, so it’s probably something you did when you set up the iPad. I hope Apple can help you figure it out, but my guess is that you’re stuck with it until you can get your hands on that iPad.

 

[applehead50]

Keychain info isn’t part of family sharing, so it’s probably something you did when you set up the iPad. I hope Apple can help you figure it out, but my guess is that you’re stuck with it until you can get your hands on that iPad.

You're right, and I removed all of my saved passwords just to be safe. I'm probably just going to switch to 1Password. Apple is working with me to see if I did something, but they have told me that the only way for my info to get pulled in is if I sign on to my Apple ID on that device, and, as per my post, I never did to my recollection or my e-mail record.

 

[chabig]

I use and like 1Password.

 

[applehead50]

Looks like it's my own fault. Doing some tests on my tablet, I did an erase everything and set it up using a family ID, then I logged out of the family ID and logged into my ID on the device. It downloaded all of my passwords, and sent no notifications to my e-mail address that my ID logged into a device. There's a good chance I logged in with my information and forgot about it. Going to call Apple to find out why I got no notification.

 

[applehead50]

So the question I have here is this, why does this device not remove those passwords when I sign out of the device? What sort of sense does that make?

 

[friednoodles]

So the question I have here is this, why does this device not remove those passwords when I sign out of the device? What sort of sense does that make?

Whether the data remains or is deleted functions exactly like any other category of iCloud data.

When you sign out of an iCloud account (or sign into another iCloud account), you have the option of Keeping or Deleting the local copies of data from the iCloud account. This includes things like contacts, reminders, calendars, etc and of course keychain entries.

If you choose not to keep the data, the keychain entries from iCloud will be removed from the local device.

If you choose to keep the data, all of the keychain entries remain and become local entries. If you then sign into another iCloud account that doesn't utilise keychain, the local keychain entries will stay (and thus if you then sign out of that new iCloud account they'll remain as well, as they're now local entries and nothing to do with iCloud). If the new iCloud account does utilise keychain, it'll sync/merge them with your local entries.

 

[Rockytopjlo]

Up front, I'm working this closely with Apple right now and we're working to try to sort out the issue. Problem is the tablet is in a remote physical location and I don't have access to troubleshoot. I'm going to try to recreate this issue with my personal tablet. I'm posting here for awareness and help to try to figure out what I did (or is this a security flaw).

Months back, I upgraded to an iPad Pro 10 inch. I followed the exact steps for preparing an iPad for sale (removed Find my iPhone, erased everything) and a few months later I decided to give that tablet to my child.

I created an Apple ID under family sharing and set up the iPad with that Apple ID. Looking at my e-mail records, I see the e-mail notification from my child's family ID when I logged in to the device. From that point forward, it was the only ID signed on to that device according to my memory and my e-mail records.

Fast forward to now, where I was notified and received proof that my Safari saved passwords showed up on my child's device.

My only family sharing setting turned on was App Purchases. I never logged into that device with my ID (that I can prove at this point with my memory and e-mail records).

On the surface, it seems to me that the device (and that AppleID) some how picked up old data from my tablet (sounds impossible) or sucked in my data (possible?).

My child does not have iCloud set up on that account, I just tried logging into that account on iCloud and it asked me to set up iCloud. Is it possible my child's account pulled from my iCloud information instead?[/QUOT

[doublepost=1552760889][/doublepost]This happened to me too. My son had all of my password and credit card information on his iPad. We use Family sharing and are singed into our own include accounts. But it turned out that my email address was used as his iCloud recovery email address. I took that email off of his iCloud account, turn off his keychain, then turned it back on and all the passwords were gone. Bad thing was that all of his passwords were gone too, but I have them in my keychain so it was not a total loss for him. Dig deep into both of your iCloud accounts. You probably have a common email in there somewhere that is linking the account (even though it should not).

 

[AlexStephenson68]

I have the same issue, I have just seen mine and my wife's passwords on my sons iPod. We use family sharing, and sometimes when they ask to buy, it offers to log in locally to authorise purchase. I was not expecting all my safari usernames and passwords to be copied on to his account.

I can delete them, but how many has he learnt, there are over 100+ accounts. And how do I know they will not reappear at some point in future. What I don't understand is on my other sons iPhone, there was just one account, bad enough as this was Amazon and he could order anything with this.