All Devices PSA: Serious bug, all website & app passwords visible without authentication

[Knightcastle]

As originally reported on reddit. (inc. video)

A number of users have reproduced this on a number of devices.

Unconfirmed but there is some discussion that disabling FaceID/TouchID is a temporary fix.

Probably worth avoiding this beta for now

 

[2Xtreme21]

Yup, got it to work on my iPad Pro 11. Scary.

 

[Knightcastle]

Also now confirmed to work on saved credit cards.

https://reddit.com/r/iOSBeta/comments/cc4zix/bug_saw_a_recent_post_on_rios_of_somebody/

 

[Oridus]

XS max pub beta 2, cannot reproduce. Asks me for Face ID authentication.

 

[bransoj]

Same beta here on a 6S...just tried entering that section and it asked for Touch ID to continue.

 

[jonblatho]

XS max pub beta 2, cannot reproduce. Asks me for Face ID authentication.

It took several tries for me on my XS. Press the row really quickly; you may need to use two fingers to do it. Cover the sensor housing and cancel any "Face Not Recognized" prompts that show up.

Eventually, it’ll let you in.

 

[Ron21]

I can't reproduce on my X with 12.3.1

 

[Oridus]

It took several tries for me on my XS. Press the row really quickly; you may need to use two fingers to do it. Cover the sensor housing and cancel any "Face Not Recognized" prompts that show up.

Eventually, it’ll let you in.

Wow. You are correct. Got it to work.

 

[dk001]

Unable to replicate.
Tried this on XS Max PB2 and it consistently asked for FaceID
Tried this on IPP 21.9 G2 iPadOS and it consistently asked for TouchID

 

[1144557]

Got it to work once, and they certainly need to patch it. But this is assuming someone got into your unlocked phone already too (and access to other stuff anyway) and knew about the bug which wasnt patched quickly as the next beta should be a few days.

 

[Knightcastle]

I can't reproduce on my X with 12.3.1

I think it’s been narrowed down to this beta of iOS 13 only.

Not happening in 12.4, not happening in previous 13 betas. Confirmed on PB & dev beta.

 

[bydandie]

We need to remember that if the person has access to your device already then being able to access your passwords is kinda moot. Anyway, it'll be fixed in the next beta.

 

[Applefan2015]

No saved passwords on my device

 

[davethorp]

We need to remember that if the person has access to your device already then being able to access your passwords is kinda moot. Anyway, it'll be fixed in the next beta.

Yeah it’s a serious bug and Apple will surely fix it but as you say in order for someone to be able to exploit it they would need to unlock the device with your passcode or face/touchID. If they managed to do that they would be able to get into the passwords anyway

 

[Knightcastle]

Yeah it’s a serious bug and Apple will surely fix it but as you say in order for someone to be able to exploit it they would need to unlock the device with your passcode or face/touchID. If they managed to do that they would be able to get into the passwords anyway

Only if they had access to your face/finger/passcode for a second time?