Accessing keychain items with "ThisDevice" protection class about keychain-dumper HOT 6 CLOSED

So my understanding is that "ThisDeviceOnly" prevent's the values being backed up or being synced to another device. You should still be able to read the values as long as the device is unlocked. I'll take a look into this once i get chance.

from keychain-dumper.

I tested several protection classes, with a simple custom app. The result can be seen below.

[ACTION] Select Entitlement Group by Number: 11
[INFO] 94FBXXZG2J.de.mezdanak.AutoFillTest selected.
Generic Password
----------------
Accessible Attribute: <SecAccessControlRef: 0x102375e30>
Service: AutoFillTest
Account: dump-me
Entitlement Group: 94FBXXZG2J.de.mezdanak.AutoFillTest
Label: (null)
Accessible Attribute: kSecAttrAccessibleWhenUnlockedThisDeviceOnly, protection level 5
Description: (null)
Comment: (null)
Synchronizable: 0
Generic Field: (null)
Keychain Data: password_thisdeve_only

As can be seen the password is shown without any issues (as @0xln assumed). Therefore, I assume that the google app might use Secure Enclave (SE) to further protect the keychain items. This would totally make sense, if the app is bond to the device itself.

from keychain-dumper.

Tested on my phone, iPhone 7 iOS 13.2.2 checkra1n
When run, the device pops up a TouchID authentication and once authorized, all Google Authenticator codes including ThisDeviceOnly ones are printed
Edit: They have data in the Generic Field field, however the Keychain Data is null because it isn't valid utf-8. #48 fixes this.

from keychain-dumper.

Nice debugging! I’ll take a look at that PR in a bit more detail later this week. Thanks!

from keychain-dumper.

Can confirm having the same problem with authenticator data field being null, and #48 indeed does fix it. Thank you guys!

from keychain-dumper.

Looks like #48 fixed this. Closing.

from keychain-dumper.