iCloud app data backups - store passwords?

[Retired Cat]

Suppose I have a third party app that needs a username & password to log in, like New York Times for iOS.

When I back up the data from this app to iCloud, is the password included in the saved data?

In the unlikely event that my iCloud account is hijacked, I don't want someone restoring my app data and stealing my passwords.

 

[Rigby]

It depends on how the app stores its password. If it is stored in the device's keychain as intended by Apple, then it cannot be recovered from an iCloud backup on a different device (because the keychain is encrypted using a hardware key that is unique to the original device). If the app (stupidly) stores the password in unprotected app storage, it may be possible to extract it.

Most apps (including all the standard Apple apps) use the keychain for passwords these days though.

 

[Retired Cat]

Thanks for the info. I feel better knowing that there is encryption tied to each specific iPhone.