Home > Computing > Linux

This Is Why We Have Betas. iOS 13 Beta Shows Saved Passwords

By Laura Tucker
News Ios 13 Security Bug Featured

There’s a reason we have beta versions of software: all the kinks need to be worked out. This is also why using beta versions always come with warnings and disclaimers that you’re using the software at your own risk.

Users of the iOS 13 beta have discovered that there’s a bug that makes it easy to access the data in “Website & App Passwords” in the Settings app. Certainly, this is something Apple needs to get fixed before the official release, expected for September.

iOS 13 Security Bug

iOS 13 has many great new features, such as the long-anticipated dark mode in apps and sliding keyboard. I’m always an early adopter of iOS public betas, and both iOS 13 and the new iPadiOS 13 are definitely fun to use.

However, the bugs are never a fun thing to deal with, but it’s something that comes with the territory. But this iOS 13 bug, that it can expose your stored passwords, is a particularly frightening bug. And if you haven’t tried iOS 13 yet, I wouldn’t do it until that’s worked out.

This flaw in iOS 13 makes it easy for anyone to bypass the biometric authentication in Settings to access the passwords that you have saved in the iCloud Keychain.

If a user keeps tapping the “Website & App Passwords” menu on your iPhone, it will eventually allow them to see your stored passwords and logins, even if they have not authenticated their identity.

This beta bug was found in the developer beta 3 of iOS 13 that was released at the beginning of the month. I am using the second public beta that was released a few days later, and I can’t get my iPhone to replicate the bug. I cannot get into the passwords on my iPhone 7 unless I use the Touch ID, no matter how many times I repeatedly tap it and no matter how many times I hit cancel and try tapping it again.

Likewise, I can’t get it to replicate on my iPad Pro 2018 using the second public beta of iPadiOS 13, either.

News Ios 13 Security Bug Iphone

This means either this security flaw is only in developer beta 3 or that it was fixed before they released public beta 2.

It should be noted that regardless of which beta version you are using, anyone who picks up your phone would not be able to even access the stored passwords in Settings as they would not be able to get past the biometric login to your device. You would have to leave it lying around accessed. My devices by default lock after a few minutes of inactivity. So you would have to have it lying around and would have to have the that autolock disabled.

Beta Beware

Again, this is why we have betas, whether developer or public, so that these bugs, especially important ones that deal with privacy and security, can be discovered and fixed before software is officially released.

But while this software could potentially reveal all your passwords, the likelihood that your device is lying around accessed to begin with isn’t very likely, and I could not replicate the bug in iOS 13 public beta 2.

Nonetheless, it’s an important bug to be aware of if you are considering downloading a beta version of iOS 13. You want to be sure you’re using a version that eliminates all possibility this could happen.

Have you downloaded the beta version of iOS 13? Will this security flaw prevent your from doing so? Add your thoughts to our comments section below.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.