iPhone Weird password request? Is this legit.

[ghsDUDE]

I got a new Mac the other day and went to set it up with iCloud. I kept getting multiple messages on my iPhone after my Mac was setup to type in my Apple ID password to ensure all cloud features worked on my Mac.

Today, I went to go into my Home App and it said I needed to turn on iCloud Keychain to get it to work properly. The weird thing is I’ve had iCloud Keychain enabled for years.

First I was asked to type on my iCloud password, then I was asked to type in my Mac password (on my iPhone) then iCloud Keychain turned on and worked again.

Does that sound normal? I never had to type in my Mac password on my phone before, but everything is working fine now. Just thought I’d ask and provide a few screenshots.

 

[Analog Kid]

My suggestion is to call Apple and confirm. Every now and then the iCloud security system seems to freak out on me and issue all kinds of requests for passwords and notifications that new devices have signed on. Every time it leaves me really uncomfortable.

I've had Apple devices ask for the password for other devices before, and I think it's atrocious security policy. By calling Apple, I think you can a) determine if this is legit (I can't say with confidence) and b) if it is, remind them how confusing this practice is.

It seems to me that it's encouraging people to accept system prompts that should naturally draw suspicion.

 

[Apple_Robert]

Looks legit to me. Sometimes iCloud can have a lag. And even if you are logged in on your end, another Amazon server may have to sync to see you etc.

I have had similar in the past although it only happened once that I recall.

 

[0128672]

Looks normal to me for the 2FA on your devices. I've been through that same loop when setting up a new Mac, and although it's mildly annoying, the security is worth it.

 

[ghsDUDE]

Thanks for the responses.

Yeah, setting up the new Mac seemed to throw everything in limbo. Was really surprised to see my iPhone get asked to provide a Mac password...but everything is working properly now.

 

[zorinlynx]

Correct me if I'm wrong, but I think the reason for this is that "iCloud Keychain" never actually stores your full keychain in the cloud. But rather it just uses the cloud as a syncing mechanism to keep all the devices in sync. Apple calls this "end to end encrypted data".

When you turned on iCloud Keychain on your phone, it needed an updated copy of the keychain, and the device it went to was your Mac. Your Mac uses your login password to encrypt the keychain, so you needed to enter this password on your phone for it to be able to decrypt it.