> My question is, why does Apple have all of this personal, private information, stored in plain text?<p>iCloud backups are usually encrypted (by default with a key Apple possesses). It's possible Apple stores this data in a database, though; as far as I can tell, it's a list of devices authenticated to your Apple account. The name and model of the device are probably there so you can easily manage them from a list of stored passkeys somewhere, as the only identifiers that need to be stored are the key ID and the public key which you probably wouldn't recognise if you tried to check your security settings.<p>> Is that how passkeys always work?<p>No.<p>Bluetooth passkeys generally work via CTAP2 with the key information encrypted on-device (though this does leak your BT MAC address to your immediate surroundings and leaves a pairing record on your computer, obviously), USB passkeys work by storing a key and signatures on the USB device itself, and every software-defined passkey implementation I've seen uses end-to-end-encryption for exchanging keys.<p>> Does every website where you login with a passkey get your device model, name, UDID, and last 4 characters of your device serial number?<p>No. Most of this information seems to be collected specifically for Apple's iCloud passkey sync mechanism. Passkey authentication should export a unique key ID per website/session, a public key signature for verifying authentication, and optionally a vendor ID for the "only permit certain types of passkeys" restrictions (though those should not be used for almost anything).<p>> I have no idea. I don't know how passkeys are implemented. But it's something we ought to know, something that passkey vendors ought to tell us. The privacy implications of widely distributing that information are disturbing. Downloading my data from Apple has brought more questions than answers.<p>If you hook a device up to a cloud account, you should expect the identifiers for that device to come with it. This is done at the very least to enable their theft protection system.