Need help with iCloud keychain backup

[733sam]

Hi,

I have MacBook pro MacOS Monterey, my room mate friend [lets call him X] logged out of my Apple ID on my Mac and used his Apple ID to logged in and used it for some days.
The same person X used my another room mate's iPad [lets call him Y] with X's credentials after logging Y's out of his iPad.

We all have Keychain turned on. Now my room mate Y can see my saved passwords on his iPhone and also X's passwords.
I was shocked and tried to figure out how this happened and later find out the above as this happened couple of months ago.

I'm trying to contact X to find if he can see my passwords and all. If he can, how do I deal with this ?

Thank you..

Edit- I cannot see anyone's password or contatcs other than mine, there were some documents and photos of X's on my recent folder in mac which are gone now. I have to see my room mates Y phone if the contacts are also synced to his account.

X logged out his Apple ID after couple of days, I didn't signed in immediately. Later in the week I saw X's name on my iPhone in the list of devices for the name of my mac. Then in settings I completely removed his account and had to change his name manually.

PS- I'm new to using Mac but have been iPhone for years. I didn't realized it was going to be this complicated.

 

[Sheepish-Lord]

Are you a math teacher trying to trick us into learning?

 

[NoBoMac]

Change your passwords, as there is no unmerge iCloud Keychain command/option.

For future reference, going to let someone use your Mac, create an account for them or enable guest account, so that Keychains won't meet.

 

[Brian33]

Yikes, what a mess. My guess (and it's only a guess) is that when X used your Mac account, logged you out of your Apple ID and into his, that your keychain (which was still on your Mac account) was merged with X's. Then later, when he later did the same thing to Y's iPad, Y's keychain was merged into X's keychain. Those merged keychains also remained on the devices (even after X logged out), so they became available to you and to Y.

If that's the order that it happened, I'd predict that you can see X's entries (but, I think, not Y's), because X's would have been left on your Mac account and merged with yours when you re-logged yourself into your Apple ID. I'd predict that X can see all of yours and all of Y's (that existed at the time -- not any new ones). And I think Y would be able to see X's and yours, also.

(However, I don't use iCloud keychain and may misunderstand how it works -- my hypothesis might well be incorrect.)

I'm guessing that @NoBoMac is right, and you (and Y and X) should change all passwords. I'm really shocked that something this bad could happen so easily. Wow. Very unfortunate. : (

 

[Brian33]

Thinking more about this... if my idea has any merit, it seems like the same "merging" would occur for Contacts. I'm curious if anyone of you has noticed any extra contact entries...

 

[733sam]

Are you a math teacher trying to trick us into learning?

I wish, this is a nightmare.. harder than Calculus, Geometry combined

 

[733sam]

Change your passwords, as there is no unmerge iCloud Keychain command/option.

For future reference, going to let someone use your Mac, create an account for them or enable guest account, so that Keychains won't meet.

I deleted my passwords from Y's phone as he is my room mate and have access to his phone with his permission. So if I can get access to X phone and remove them, will it be deleted permanently or they still have the back up ?

 

[NoBoMac]

If that's the order that it happened, I'd predict that you can see X's entries (but, I think, not Y's), because X's would have been left on your Mac account and merged with yours when you re-logged yourself into your Apple ID.

All depends on sequence of events. Could see Y if:

• X signs into Apple ID, merges their Keychain with OP on Mac and syncs back to iCloud under X
• X signs out of Mac, leaves themselves signed in to Apple ID
• X signs into Y iPad, says "ok" to merge Keychains: X Keychain now has OP, X, and Y and syncs to their iCloud account
• OP signs into Mac, since still signed into X, gets their Keychain merged into Mac Keychain
• OP signs back to their Apple ID, merges their Keychain back to iCloud, no longer getting "updates" from X (anything new from X will not show up)

So if I can get access to X phone and remove them, will it be deleted permanently or they still have the back up ?

It will delete permanently.

 

[733sam]

Yikes, what a mess. My guess (and it's only a guess) is that when X used your Mac account, logged you out of your Apple ID and into his, that your keychain (which was still on your Mac account) was merged with X's. Then later, when he later did the same thing to Y's iPad, Y's keychain was merged into X's keychain. Those merged keychains also remained on the devices (even after X logged out), so they became available to you and to Y.

If that's the order that it happened, I'd predict that you can see X's entries (but, I think, not Y's), because X's would have been left on your Mac account and merged with yours when you re-logged yourself into your Apple ID. I'd predict that X can see all of yours and all of Y's (that existed at the time -- not any new ones). And I think Y would be able to see X's and yours, also.

(However, I don't use iCloud keychain and may misunderstand how it works -- my hypothesis might well be incorrect.)

I'm guessing that @NoBoMac is right, and you (and Y and X) should change all passwords. I'm really shocked that something this bad could happen so easily. Wow. Very unfortunate. : (

I cannot see anyone's passwords other than mine. After X logged into my mac, I guess when my mac is connected to wifi my keychain is synced to X's account. And then when he logged into Y's iPad, X's and my keychain is merged into Y's device.
I was naive and though if I log out my Apple ID in Mac my data will not be shared if someone else logged into my Mac. Well lesson learned..

 

[Brian33]

All depends on sequence of events. Could see Y if:

I see... yes, I agree it could happen that way. So many scenarios!

X signs into Y iPad, says "ok" to merge Keychains:

So apparently there would have been a dialog box and option to merge or not -- I didn't know that, thanks. So there are even more possible combinations of events.

I cannot see anyone's passwords other than mine.

That surprises me some, but I see now there are more possibilities and outcomes than I thought.

I was naive and though if I log out my Apple ID in Mac my data will not be shared if someone else logged into my Mac. Well lesson learned..

I doubt you are the only one to have this happen. I think I can sympathize with you, it must be a gigantic hassle. I'm going to make sure my family and friends understand not to get into this situation. It seems like the rules should be: (1) don't let anyone use their Apple ID with your Mac account (instead have them use Guest User or create a new account on the Mac) and (2) don't let anyone use their Apple ID on your iOS device, at all.

Even though my family uses 1Password instead of keychain for passwords, I worry that other iCloud-synced data (like Contacts?) could get similarly merged if these "rules" were violated.