8

Apple will use SMS as a fallback for two factor auth, if an authorized device is not available. Given that SMS security is a dumpster fire, this seems unwise, and I'd like to disable the feature. However, I'd still like to have a fallback if an authorized Apple device isn't available for 2FA. You'd think that's what a recovery code would be for, but I can't seem to find a path to access my Apple ID by using my recovery code instead of an authorized device.

Improve this question
1
  • You'd like to disable the feature?! You must remember you're dealing with Apple, who won't let you disable their incessant nags over updates and upgrades - even for updates to "Garage Band" even though that update is incompatible with the OS... they don't allow you to delete Siri, despite massive (and proven) risks. They've made it obvious they don't particularly care what you'd like. I do hope you get a helpful answer, but please don't hold your breath. :)
    – Seamus
    Commented Mar 29, 2021 at 5:38

1 Answer 1

Reset to default
5

Unfortunately you cannot disable the feature.

Your best bet is keeping the number used completely private. I.e. do not use your main phone number for this - use a number specifically reserved for 2FA codes so that this phone number is not shared with others.

Also I would like to point out that the loophole described in the link you have included has actually been closed shortly after that article was written through a collaboration between T-Mobile, Verizon and AT&T.

However it is still true that if you have some other means of providing a second factor than SMS, then you should definitely go for that instead. SMS is the least desirable of all options.

Improve this answer
6
  • 1
    Thanks, that's disappointing, but not surprising. It's good that the carriers have closed that particular loophole, but SMS is still far from secure. I'm not ready to pay for a dedicated line just for 2FA, but I am using this service to monitor my mobile number for unauthorized changes.It's not clear what an Apple recovery key is actually good for -- I've explored all the "I forgot" paths for account access, and haven't found any that involve the recovery key.
    – Diogenes Pontifex
    Commented Mar 29, 2021 at 22:18
  • 2
    The recovery key actually serves a purpose, and it is a very good idea to have it enabled and stored securely. Basically, if you come into a situation where you forgot the password for your account and need to recover access (or more importantly, if evildoers try to do this in your place) then Apple will ordinarily make possible for you by imposing a waiting period (cannot remember the number of days) and then doing some more or less manual checks on your identity (for example by having your verify credit card numbers, codes sent to your email address, etc). However, if you enable the
    – jksoegaard
    Commented Mar 29, 2021 at 23:49
  • 1
    recovery key then this process cannot be initiated. The only way to recover the account is by using a combination of the recovery key and a code sent your phone. Ofcourse this requires that you keep the recovery key secret while still being available when you need it, but for many that is preferable to having "some guy" at Apple decide whether or not the person requesting the account recovery is really you.
    – jksoegaard
    Commented Mar 29, 2021 at 23:50
  • 1
    Thanks, very helpful. I think I understand now. This is not well documented. Though it doesn't make much sense to use the recovery key when you've lost your password -- If you can keep a copy of the recovery key in a safe place, why not just keep a copy of your password? (Which I do, for important accounts.) On the other hand, a lot of services that use 2FA will give you one or more lockout codes, which you can use if your 2FA device is unavailable. That makes excellent sense, and is how I hoped Apple's recovery key could be used. But it is what it is, at least until Apple fixes it.
    – Diogenes Pontifex
    Commented Mar 31, 2021 at 17:33
  • It is well documented - you can read all the details about it on Apple.com. You might not think it makes sense, but it actually does. This is how a lot of services work.
    – jksoegaard
    Commented Mar 31, 2021 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .