Fresh install already has all website passwords - from where?

[propower]

Hey all

I booted from an external disk and repartitioned my 2012 MBA (erased first then repartition). I then did a clean install of 10.10.1. I logged into iCloud and loaded Safari. Note - I never used iCloud keychain!

So to my surprise Safari has all my passwords from the last few years already in the keychain. Where did these come from??????

Thanks!

 

[fisherking]

you didn't copy any settings or files over? perhaps the keychain file is backed up in icloud? (even tho you're not 'sharing' it with an idevice)?

 

[propower]

Copied nothing! Just a fresh install

So does keychain store these with my apple id?? I thought you had to turn iCloud keychain on to do this - I have never done this.

 

[Ravenis]

Is safari selected in iCloud system preferences? Probably brought them over with that

 

[propower]

Yes Safari is selected in System Preferences - iCloud. But isn;t this just for sharing tabs? I tried looking up exactly what this option does and find no clear answer. Also - if this gets passwords - what is iCloud-keychain for?

Very weird...

 

[fisherking]

Yes Safari is selected in System Preferences - iCloud. But isn;t this just for sharing tabs? I tried looking up exactly what this option does and find no clear answer. Also - if this gets passwords - what is iCloud-keychain for?

Very weird...

sharing the keychain brings it up on the mac, and an iphone/ipad. my guess is you're just backing it up in the cloud, so it's obviously just copied back from there...

 

[propower]

iCloud has a box for Safari (checked)
iCloud has a box for Keychain (not - checked)

What does "sharing the keychain" mean?
How have i enabled it - and how do i disable it?

 

[jbarley]

iCloud has a box for Safari (checked)
iCloud has a box for Keychain (not - checked)

What does "sharing the keychain" mean?
How have i enabled it - and how do i disable it?

Safari's cookies will contain those passwords, which you indicate are being saved to the cloud and subsequently being restored.

 

[NoBoMac]

Not having done a clean install of 10.10, have not seen initial setup wizard, speculation, can see happening:

• Keychain set-up on iOS device(s)
• Setup Mac: asks for iCloud ID and turns everything to "on".
• Keychain data gets pulled from iCloud

 

[propower]

I have passwords from sites that do not have cookies on my machine so the notion that restored cookies from iCloud put passwords back on my machine appears incorrect.

I don;t think it is good or right that anything having to do with any passwords should be done without the OS asking my permission or clearly stating what the results of clicking an option are. I check Safari and iCloud because by all of the Apples published data - this lets me share tabs and continue reading from one device to another. the notion of passwords being auto loaded to my keychain is wildly egregious in comparison to sharing tabs. Since there is a very specific checkbox for Keychain I find this auto Keychain behavior very unsettling.

 

[Ravenis]

just tested in a new user

skipped apple ID sign in-opened safari-clean as expected-nothing came over

quit safari, signed into iCloud, everything tried to get enabled including iCloud keychain-cancelled that and left the main services on including safari

launched safari-tabs and bookmarks showed up, no saved passwords

so the expected behavior is that it shouldn't show them on a fresh install, yours remains a mystery

You call and ask apple about this by any chance?

 

[propower]

just tested in a new user

skipped apple ID sign in-opened safari-clean as expected-nothing came over

quit safari, signed into iCloud, everything tried to get enabled including iCloud keychain-cancelled that and left the main services on including safari

launched safari-tabs and bookmarks showed up, no saved passwords

so the expected behavior is that it shouldn't show them on a fresh install, yours remains a mystery

You call and ask apple about this by any chance?

Just to be sure - You checked in Safari-Preferences-Passwords and there was nothing there?

 

[leman]

I'd suggest the following:

1. Start the Keychain Access app
2. Search for one of the mysteriously stored passwords (e.g. 'ebayuser')
3. Look which keychain the item is in

 

[xMacFeinx]

When I started up my Macbook Pro this happened. I hadn't been using keychain at all either so to my surprise all my passwords were already saved in Safari. It looks like theres a way with iCloud + Safari that it'll store your logged passwords and enter them when you install/update Safari and sign into iCloud.

I'm not 100% clear on how or what settings this involves, but at the time I wasn't use KeyChain and as stated before my passwords were stored and then uploaded into my new Mac.

 

[propower]

I'd suggest the following:

1. Start the Keychain Access app
2. Search for one of the mysteriously stored passwords (e.g. 'ebayuser')
3. Look which keychain the item is in

OK - I followed this and all of my only keychain is one called "login". All the internet passwords look the same with a "date modified" field all equal to the date and time i logged into iCloud... some of the ones whose sites I have now been to have more recent times.

Its almost convenient - and i never store critical passwords - but I really don;t like not knowing why such an important behavior like this would go on without user authorization.

When I started up my Macbook Pro this happened. I hadn't been using keychain at all either so to my surprise all my passwords were already saved in Safari. It looks like theres a way with iCloud + Safari that it'll store your logged passwords and enter them when you install/update Safari and sign into iCloud.

I'm not 100% clear on how or what settings this involves, but at the time I wasn't use KeyChain and as stated before my passwords were stored and then uploaded into my new Mac.

Interesting