24

I would like to add non-SMS, non-Apple multi-factor authentication to my Apple ID.

1Password TOTP

I'm most interested in using a "code generator"-type Time-based One-Time Password (TOTP) based on RFC 6238 implemented by client apps such as:

  • Google Authenticator
  • Microsoft Authenticator
  • Yubico Authenticator
  • Authy
  • 1Password
  • LastPass
  • etc.

I do not see any such option. Is this type of authentication available for Apple ID?

I would also be interested in adding YubiKey or other similar hardware "security keys". Or any other non-SMS, non-Apple multi-factor solutions.

Note: I am able to add Apple's proprietary "two-factor authentication for Apple ID" integrated within iOS and macOS as an alternative to SMS-based "two-step verification". This question is asking instead for a 3rd-party-compatible two-factor mechanism that does not involve using an Apple device signed in to iCloud.

Related:

Improve this question
4
  • 5
    I second your request. It is indeed a shame that apple implemented the way they did. Mostly apple would orient you to 2FA based on a 2nd apple device which is crasy unreliable, when you are stuck with a lost device or broken device...
    – Guy
    Commented Jun 1, 2019 at 9:28
  • 3
    In 2021 Apple still doesn't adopt open industry standards like TOTP for authentication, and they claim to be at the forefront of security and ease-of-use. This is quite disappointing.
    – Manchineel
    Commented Feb 7, 2021 at 13:52
  • 1
    I was surprised by this as well. I thought Apple was supposed to be ahead of the game on security yet falls back to woefully insecure SMS-based 2FA if you don't want to use an Apple device for it. Security, but only if you pay us!
    – Iguananaut
    Commented Apr 15, 2021 at 15:01
  • Mid-2024 here and I'm still frustrated that Apple deigns to deny the industry standard of TOTP.
    – WackGet
    Commented Jun 3 at 13:35

2 Answers 2

Reset to default
16

No, you cannot use TOTP-authentication as implemented by for example Google Authenticator (i.e. RFC6238) with Apple-ID. The only supported system is Apple's own system, which works very similarly to TOTP.

This hasn't got anything to do with the SMS-requirement at all.

As a collary to the above, hardware-based OATH-TOTP solutions such as a YubiKey won't work with Apple-IDs either.

Starting next year, Apple is going to start supporting hardware Security Keys. The supported keys are physical, and they communicate with an iPhone or iPad over Lightning, USB-C or NFC.

Those keys are not TOTP-based, and so you will still not be able to use the listed third party app authenticators, such as Google Authenticator or Microsoft Authenticator.

It is currently unclear whether Apple will allow using Security Keys only on Apple devices (such as iPhone and iPads) - or it will be generally available on desktop computers as well. Your request for a third party solution that does not require an iPhone or iPad means that it is still unclear whether a third party hardware solution could be used at all - even if the requirement of it being TOTP-based was removed.

Improve this answer
2
  • 1
    How is Apple's system "very similar" to TOTP? With TOTP there is a shared key I can use to generate codes via whatever app I want, on whatever devices I want. With Apple's system I'm limited to use a single phone number or my own Apple devices (if I own any).
    – WackGet
    Commented Jun 3 at 13:33
  • 1
    @WackGet I'm talking about the way it works - i.e. if you look at it from a computer science perspective, it's essentially the same as TOTP. In practice most TOTP-implementations available to ordinary users are based on RFC6238, so they won't work with Apple's system. Apple made their own implementation, which functions quite similar to TOTP with a shared key that can be used to generate codes offline. It is entirely possible to implement that on non-Apple devices too, so it is not a theoretical limitation - it is just a limitation based on what's available on the market currently.
    – jksoegaard
    Commented Jun 4 at 10:38
5

Apple has announced that starting in "early 2023," security keys will be available for iCloud.

However, there is no indication this will support non-physical security keys. The screenshots Apple has provided clearly show a requirement to insert/tap your key, rather than to setup a code-generating app.

It is likely that the SMS requirements could be waived if one of these were to be set up, but that is not known at this time.

Security Keys

Apple introduced two-factor authentication for Apple ID in 2015. Today, with more than 95 percent of active iCloud accounts using this protection, it is the most widely used two-factor account security system in the world that we’re aware of. Now with Security Keys, users will have the choice to make use of third-party hardware security keys to enhance this protection. This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government. For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key as one of the two factors. This takes our two-factor authentication even further, preventing even an advanced attacker from obtaining a user’s second factor in a phishing scam.

Improve this answer
7
  • The security keys that Apple supports are not TOTP-based, which is what this question is about. So they are not relevant here. You cannot use the app authenticators mentioned in the question with the new Apple security key functionality.
    – jksoegaard
    Commented Dec 9, 2022 at 13:25
  • @jksoegaard While true that the OP is asking specifically about TOTP, the title does not make that distinction and I made it clear in my response that TOTP was still unavailable. However, for some people TOTP is not required.
    – Ezekiel
    Commented Dec 9, 2022 at 14:13
  • 1
    This is a welcome development and I see it as a +1 as moving away from Apple's current TFA and prior two step implementations will help with real live security scenarios that OP is likely to care about even if they didn't phrase the question to anticipate this roll out.
    – bmike ♦
    Commented Dec 9, 2022 at 14:18
  • I am using my yubikeys for 2FA for my Apple ID, but I don’t believe there is any way to disable Trusted Phone Numbers. I’d be happy to enable trusted phones, as long as Apple guarantees that they’ll only use a device code sent to that IMEI only, and would not provide a ‘don’t have your device? Click here to send an SMS instead’ option…, anyone know if it’s possible to disable either a) SMS entirely if hardware keys like yubikeys are setup, or b) even better, keep “trusted phone number(s)” but disable the ability for SMS to be used on them?
    – likethesky
    Commented Dec 20, 2023 at 20:13
  • 1
    @Ezekiel Well sure, there’s no way for any generic phone number. I’m saying Apple when they send to iOS devices only, could in essence ensure that they have verified the device’s IMEI and make it a method as secure as using a Yubikey. In fact, I think they likely already do, the big flaw in that, is that they also allow one to send an SMS to that same number. That, as you & I know, is inherently insecure. My question for b) is: can I use my iOS devices (like a yubikey), but disable Apple also using the SMS network to communicate with those phones?
    – likethesky
    Commented Dec 20, 2023 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .