Timeline for Apple's 2FA and the notion of "trusted device" and "trusted browser"
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 27, 2019 at 5:19 | vote | accept | peter.rando | ||
| Feb 25, 2019 at 8:25 | comment | added | peter.rando | Let us continue this discussion in chat. | |
| Feb 25, 2019 at 8:17 | comment | added | peter.rando | Ah, just saw your "no problems with that". Sounds good, thanks for that as well. It will take some set up in advance, but I'm going to give it a try later this week. | |
| Feb 25, 2019 at 8:16 | comment | added | peter.rando | Lastly, you said: The only thing this concerns is when you login to the Apple developer account. You can use Xcode without having it login to your Apple developer account at all *. But I *do choose to let Xcode sign in to get provisioning certs, so there will be weekly-ish attempts at signing in, and while I think it should be fine, I think the only way to know how this will work is to just try it. It might be a bit of a nuisance because of using someone else's SMS, but hopefully not bad if it's only during a single short test window on one day. Thanks for your help. | |
| Feb 25, 2019 at 8:15 | comment | added | peter.rando | All this said, your last comment includes a useful piece of info that I was in fact looking for, which is that Xcode stores this token in the Keychain, which makes perfect sense. Thank you for that. That tells me that it should persist regardless of browser sign-ins, cookies, etc., which is good. And I can completely control when Xcode is has network access at all times, so that's great. I'm not going to keep individual tracking cookies around; I understand your point, but not willing to deal with exceptions. | |
| Feb 25, 2019 at 8:02 | comment | added | jksoegaard | Xcode has no problems with that at all. | |
| Feb 25, 2019 at 7:54 | comment | added | peter.rando | I do understand how these kinds of systems can work, I just don't know how Apple has implemented theirs. There are a lot of moving pieces, and because of the nature of my work, I'm extremely picky about what and how personal information gets tracked, including location. So even Apple doesn't get to track me 99% of the time. Fun fact: many apps don't know how to behave if they see they're online, but are firewalled from accessing their own servers. I'm not sure how Xcode will deal with this. Based on what I've read here, I'll need to experiment with that. | |
| Feb 25, 2019 at 7:42 | comment | added | peter.rando | Unfortunately, the VoteUp, VoteDown and Accept buttons are not rendering for me right now! I examined the source and I see where they're supposed to be, I can see that they are svg elements, and I played around modifying the css directly in the browser, all to no avail. I'm not in a situation where I can get on a VPN and use a different browser right now, but I just left myself a note to do so the next time I'm at another location. Sorry, it may be 2-3 days, but I will get back to this. I hate it when I see good answers that never get accepted. | |
| Feb 25, 2019 at 0:15 | comment | added | jksoegaard | If you do use Xcode's easy way of downloading provisioning profiles and uploading builds, etc. - then Xcode will login to your Apple developer account. In that case it needs to be trusted, which it does automatically by storing the token in the Keychain. So you trust Xcode once, and then you're not distracted by 2FA anymore. | |
| Feb 25, 2019 at 0:14 | comment | added | jksoegaard | @peter.rando I think you have confused what is actually involved in the 2FA process here. There's no "trusting the computer" - it doesn't have anything to do with your specific computer as such. That's also why it doesn't matter that you have VPN, and it's why it doesn't just suddenly require 2FA when you connect to the internet or anything like that. The only thing this concerns is when you login to the Apple developer account. You can use Xcode without having it login to your Apple developer account at all - you can do that manually from a browser. | |
| Feb 25, 2019 at 0:12 | comment | added | jksoegaard | @peter.rando The "accept button" is simply the greyed out "checkmark" on the left of the answer. Click that and it becomes green. | |
| Feb 25, 2019 at 0:07 | comment | added | peter.rando | Wait, I don't see an "accept" button! I need to leave now, late for an event, but I will be back later tonight to try again. | |
| Feb 25, 2019 at 0:04 | comment | added | peter.rando | So it's sounding like Apple's 2FA model is pretty close to a one-and-done as far as SMS goes, thought I'm not sure I've heard explicitly yet what actions might trigger another SMS verification...? I'm going to accept this answer, as much for your previous answers on the previous (unwieldy) question and ongoing chat, which have been very helpful. I'd still like to know about how trust is (or will be) implemented on the dev computer. Will certs stored within Xcode itself suffice? | |
| Feb 24, 2019 at 23:22 | history | answered | jksoegaard | CC BY-SA 4.0 |