Keychain: Why are a number of web form passwords modified at the same date and time?

Question

Keychain: Why are a number of web form passwords modified at the same date and time?

I was cleaning up my keychain and checking on old accounts to delete and clean up my internet presence a bit today when I noticed something odd. It appears that on September 20th I had a large number of web form passwords (blue @ symbol) modified at the same time. There were 17 of them modified first and the 1 second later another 5. In the "Date Modified" column I see the time as 2:48:36 pm for about 17 of them and then another 5 are 1 second later at 2:48:37 pm. The date given is 10 months ago so I have no memory of that day. I could not have been me doing it because I couldn't get the time to be so close together.

Does anyone see this in their keychain too? I not, any ideas what this could be? Some sort of hack to my account?

Posted on Jul 31, 2021 7:59 PM

Reply

Answer 1

Aug 3, 2021 11:20 AM in response to SpringFlower22

FWIW, I have very many similar entries in my Keychain on MacBook Pro Catalina and is probably all very normal.

I suspect it might have something to do with the normal operation of iCloud syncing and data refreshes because most (all?) have names that ref Apple... com.apple.iclouddxxxxxx for example.

Reply

Answer 2

judysings

Community Specialist

Aug 1, 2021 2:22 PM in response to SpringFlower22

Hi SpringFlower22,

Thanks for reaching out using Apple Support Communities. Here to help.

We understand you have concerns regarding duplicate modifications to a keychain password in a short period. It is difficult to speculate on this. Were these all for the same website?

Regarding account security, we will link to a checklist below of steps to take to ensure there is no unauthorized access to your account.

Checklist: If you want to see if anyone else has access to your device or accounts

You can also learn more about iCloud encryption and security at the link below.

iCloud security overview

Hope this helps! Take care for now.

Reply

Answer 3

Aug 3, 2021 10:33 AM in response to judysings

Hi Judysings,

Thank you for taking the time to look over my question. To answer your first question, no, these are all different websites.

I have looked over the links you sent. I did go and check to see if my AppleID was logged in to any other devices and it is not. Also as I was logging in to answer this question (on a Chrome browser) I was asked to to enter a code from another device and confirm this was me and it was safe.

I should also add that in addition to the passwords which show up with a blue @ symbol, there was also many "application password" lines which are shown with a pencil and three dots as a symbol. This included things with names such as: AirPort, Safari History Key, and Safari Credit Card Autofill Metadata.

You can see why I would be concerned.

Reply

Answer 4

Aug 3, 2021 10:37 AM in response to judysings

This is a screenshot of part of the keychain which I see how many of the web form passwords and application passwords were accessed so close tother (within 1 minute). There are more that didn't fill the screenshot.

Reply

Keychain: Why are a number of web form passwords modified at the same date and time?

Similar questions