6

My Apple-ID (e.g., on https://appleid.apple.com/ ) is set up to require entry of a 6-digit code sent to my registered Apple products.

This code is being sent to the same device I'm currently requesting to log in. I feel this absolutely defeats the purpose of this 2-Factor Authentication: If a person knows my password, this person can receive the code on that device, and access my apple account without any problems.

Is this a bug or can I set up / change how this security step works?

4

This is how it works and isn't a bug. It's two-factor authentication, not prevention.

Yes, it's being sent to that device but, as you mentioned, it's also being sent to all other devices signed-in with the same Apple ID. This is meant to notify the user that a sign-in is being attempted.

To use your example, if you're trying to log into a Mac that means you're not currently logged-in. In that case, the Mac will not get the code because it's only sent to devices that are logged-in with that ID. Your Mac is not logged-in at that point.

You can prevent this in two ways:

  • mark the browser/device as always trusted (which makes you less secure - the log in request won’t then broadcast to all your other devices)
  • remove that device from your trusted list - all sign in requests will require a different device to receive your 6 digit pin (further locking down that one device - at the expense of not being able to use it as an approved for your iCloud)

If you're already logged-in to your Mac and now you want to add a new device to iCloud, your Mac will get the code because it's a device logged-in with your Apple ID and you've previously 'trusted' that Mac. So now, the code is alerting all your devices that a login attempt is currently being made.

This Apple 2FA page can provide additional info.

  • In my example, I'm being logged-in: I'm accessing this website appleid.apple.com where I can manage my Apple-ID on my logged-in mac. So, the Mac is receiving this code as well. If a person knows my apple-ID password and is sitting at my logged-in Mac, 2FA is not preventing this person from accessing my account. Google's 2FA is requiring SMS-codes each time I sign in into my Google account. I don't see how I can do the same with my Apple-ID – Anton K Apr 6 '17 at 15:39
  • It's not meant to prevent access, it's meant to 1) provide additional security in case someone knows your pwd and 2) notify all trusted devices a login is being attempted. You're sitting at a device you already trusted so that device also gets the code. If you signed-out of your Mac then tried to login, the Mac shouldn't get the code. Try that and see if it works. – fsb Apr 6 '17 at 15:42
  • could you please tell me how it is providing additional security in case someone knows my pwd? (your 1st point). If someone knows my apple-ID password, and my local Mac password (note: I do not use apple-ID password to log-in into my Mac). When accessing the website where one can manage apple account, this person will just approve the sign-in himself and type in the code, that would appear on the Mac. – Anton K Apr 6 '17 at 15:46
  • It's notifying all other trusted devices about the login. The additional security is that just knowing the pwd isn't enough. At some point, you 'trusted' your Mac so Apple is notifying it, just like all other trusted devices. To your point, yes, if that person has access to your Mac (that you trusted) and your pwd, then you compromised your security. Look, I didn't create it, I'm just telling you what Apple says about it. – fsb Apr 6 '17 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .