bitwarden / bitwarden/ios

[BWA-244] Authenticator iCloud backups may not be properly encrypted

Open
#2,519 3 comments 1 reaction 0 assignees View on GitHub
app:authenticator bug
Dominant language
Swift
Stars
684
Forks
154
Avg merge
7d 2h
Merged PRs (30d)
32

Description

### Steps To Reproduce

https://github.com/bitwarden/ios/blob/3e43400359a6fc755d4b72402d639c7bf8f260f8/AuthenticatorShared/Core/Platform/Services/Stores/AppSettingsStore.swift#L460-L462
Based on the source code, the Authenticator app appears to store the key for encrypting TOTP items in UserDefaults rather than the keychain. From my understanding, this potentially means that the key is backed up to iCloud with standard data protection as part of iCloud backup rather than E2EE as part of iCloud Keychain. If I understand everything correctly, this undermines both security guidelines for the repository: https://github.com/bitwarden/ios/blob/3e43400359a6fc755d4b72402d639c7bf8f260f8/.claude/skills/reviewing-changes/reference/ios-security-patterns.md?plain=1#L13-L14
and contradicts [documentation](https://bitwarden.com/help/bitwarden-authenticator/#how-do-i-back-up-and-restore-my-totp-data): "An encrypted backup of your data is made by your device's cloud backup system, for example by iCloud or Google One. To restore your data, restore your device's cloud backup."

Please let me know if I'm misunderstanding either the code, the intended security posture for backups, or both. For additional context, Proton Authenticator encrypts iCloud backups using a key stored in iCloud Keychain, so it enforces E2EE regardless of whether a user has Advanced Data Protection enabled, which is what initially prompted me to look into this.

### Expected Result

iCloud backup is encrypted with a key only the user can access

### Actual Result

iCloud backup _may_ be encrypted with a key Apple can access

### Screenshots or Videos

_No response_

### Additional Context

_No response_

### Build Version

2026.3.1

### What server are you connecting to?

N/A

### Self-host Server Version

_No response_

### Environment Details

_No response_

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start with AuthenticatorShared/Core/Platform/Services/Stores/AppSettingsStore.swift at lines 460-462, then compare the storage behavior with the iOS security patterns reference and the linked backup documentation. Verify how the encryption key is protected during iCloud backup; done means the backup uses a key only the user can access, with supporting tests or evidence.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.