[BWA-244] Authenticator iCloud backups may not be properly encrypted
- Dominant language
- Swift
- Stars
- 684
- Forks
- 154
- Avg merge
- 7d 2h
- Merged PRs (30d)
- 32
Description
### Steps To Reproduce
https://github.com/bitwarden/ios/blob/3e43400359a6fc755d4b72402d639c7bf8f260f8/AuthenticatorShared/Core/Platform/Services/Stores/AppSettingsStore.swift#L460-L462
Based on the source code, the Authenticator app appears to store the key for encrypting TOTP items in UserDefaults rather than the keychain. From my understanding, this potentially means that the key is backed up to iCloud with standard data protection as part of iCloud backup rather than E2EE as part of iCloud Keychain. If I understand everything correctly, this undermines both security guidelines for the repository: https://github.com/bitwarden/ios/blob/3e43400359a6fc755d4b72402d639c7bf8f260f8/.claude/skills/reviewing-changes/reference/ios-security-patterns.md?plain=1#L13-L14
and contradicts [documentation](https://bitwarden.com/help/bitwarden-authenticator/#how-do-i-back-up-and-restore-my-totp-data): "An encrypted backup of your data is made by your device's cloud backup system, for example by iCloud or Google One. To restore your data, restore your device's cloud backup."
Please let me know if I'm misunderstanding either the code, the intended security posture for backups, or both. For additional context, Proton Authenticator encrypts iCloud backups using a key stored in iCloud Keychain, so it enforces E2EE regardless of whether a user has Advanced Data Protection enabled, which is what initially prompted me to look into this.
### Expected Result
iCloud backup is encrypted with a key only the user can access
### Actual Result
iCloud backup _may_ be encrypted with a key Apple can access
### Screenshots or Videos
_No response_
### Additional Context
_No response_
### Build Version
2026.3.1
### What server are you connecting to?
N/A
### Self-host Server Version
_No response_
### Environment Details
_No response_
### Issue Tracking Info
- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start with AuthenticatorShared/Core/Platform/Services/Stores/AppSettingsStore.swift at lines 460-462, then compare the storage behavior with the iOS security patterns reference and the linked backup documentation. Verify how the encryption key is protected during iCloud backup; done means the backup uses a key only the user can access, with supporting tests or evidence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100