8

My Apple-ID (e.g., on https://appleid.apple.com/ ) is set up to require entry of a 6-digit code sent to my registered Apple products.

This code is being sent to the same device I'm currently requesting to log in. I feel this absolutely defeats the purpose of this 2-Factor Authentication: If a person knows my password, this person can receive the code on that device, and access my apple account without any problems.

Is this a bug or can I set up / change how this security step works?

4

This is how it works and isn't a bug. It's two-factor authentication, not prevention.

Yes, it's being sent to that device but, as you mentioned, it's also being sent to all other devices signed-in with the same Apple ID. This is meant to notify the user that a sign-in is being attempted.

To use your example, if you're trying to log into a Mac that means you're not currently logged-in. In that case, the Mac will not get the code because it's only sent to devices that are logged-in with that ID. Your Mac is not logged-in at that point.

You can prevent this in two ways:

  • mark the browser/device as always trusted (which makes you less secure - the log in request won’t then broadcast to all your other devices)
  • remove that device from your trusted list - all sign in requests will require a different device to receive your 6 digit pin (further locking down that one device - at the expense of not being able to use it as an approved for your iCloud)

If you're already logged-in to your Mac and now you want to add a new device to iCloud, your Mac will get the code because it's a device logged-in with your Apple ID and you've previously 'trusted' that Mac. So now, the code is alerting all your devices that a login attempt is currently being made.

This Apple 2FA page can provide additional info.

7
  • In my example, I'm being logged-in: I'm accessing this website appleid.apple.com where I can manage my Apple-ID on my logged-in mac. So, the Mac is receiving this code as well. If a person knows my apple-ID password and is sitting at my logged-in Mac, 2FA is not preventing this person from accessing my account. Google's 2FA is requiring SMS-codes each time I sign in into my Google account. I don't see how I can do the same with my Apple-ID
    – Anton K
    Apr 6 '17 at 15:39
  • 1
    It's not meant to prevent access, it's meant to 1) provide additional security in case someone knows your pwd and 2) notify all trusted devices a login is being attempted. You're sitting at a device you already trusted so that device also gets the code. If you signed-out of your Mac then tried to login, the Mac shouldn't get the code. Try that and see if it works.
    – fsb
    Apr 6 '17 at 15:42
  • could you please tell me how it is providing additional security in case someone knows my pwd? (your 1st point). If someone knows my apple-ID password, and my local Mac password (note: I do not use apple-ID password to log-in into my Mac). When accessing the website where one can manage apple account, this person will just approve the sign-in himself and type in the code, that would appear on the Mac.
    – Anton K
    Apr 6 '17 at 15:46
  • It's notifying all other trusted devices about the login. The additional security is that just knowing the pwd isn't enough. At some point, you 'trusted' your Mac so Apple is notifying it, just like all other trusted devices. To your point, yes, if that person has access to your Mac (that you trusted) and your pwd, then you compromised your security. Look, I didn't create it, I'm just telling you what Apple says about it.
    – fsb
    Apr 6 '17 at 15:56
  • Apple says it is working "as intended.". My opinion: that is absurd. How secure is "telling" me on my iPhone that someone is intruding on my computer back at my house when I know that they are successful because Apple "intended" to hand them the key to get in?
    – WGroleau
    Mar 6 at 2:59
1

It's not a bug.

There is a misconception in your question that leads you to believe that this is bug: You write that the 6-digit code is being sent to the device that you're trying to log in from. This is not the case.

The 6-digit codes are not sent to your trusted device (unless you have specifically requested for the 6-digit code to be sent by SMS text message). The 6-digit code is already there, in the sense that it is actually calculated on the device.

The only thing sent to your trusted device is a notification that someone is trying to login and an approximate geographical origin of that request.

Usually you login from a trusted device such as for example logging in on the "Apple Store" app on a trusted iPhone. In this case, the 6-digit code is not requested. It is automatically calculated on the trusted iPhone and sent along with your password to the server for authentication.

The situation you're describing happens if you use a Mac that you have added as a trusted device (the computer itself) - and then try to login to an Apple service via a browser that is not trusted.

A browser, such as for example Google Chrome, does not "know" that your computer is trusted, and does not have access to the data necessary to calculate the 6-digit code itself - the browser itself needs to be trusted for that to happen. Were the browser trusted, you would not see a request for you to enter a 6-digit code, it would be automatically transmitted.

In your case with an untrusted browser, you enter your password and a notification is sent to all your trusted devices. This includes your Mac (on an operating system level - not browser level). You then get a popup with the 6-digit code that is calculated on your device. You can enter this in the browser and optionally choose to trust the browser, so you do not have to do this again.

The reason why this is not a bug is that 2-factor authentication in this case means that the user authenticates by "something you know" and "something you have". In this case the "something you know" is the password and the "something you have" is the special trust-data that makes it possible to calculate the 6-digit code.

The user that is logged on to the Mac in this particular case obviously has both, and as such it is perfectly valid to authenticate them.

Had an attacker tried to login to the web site with your password that they had stolen, they would have been stopped from authenticating because they do not know your 6-digit code.

Had an attacker tried to login to the web site from your own computer having stolen your Apple-ID password - without being logged in as your user on the computer - they would have been stopped from authenticating because they do not know your 6-digit code. It is not sent to the computer, so they cannot just "snoop" it from network traffic.

Had an attacker tried to login to the web site from your own computer having stolen your Apple-ID password - and they're already logged in with your user account on the computer - then this won't stop them. They already have access to the trusted data and they know your password. Even if the notification was not sent to this device, but only to your other devices, it wouldn't have helped anything - the attacker could just generate the 6-digit code themselves on the computer. The good thing though is that you get a warning on your other trusted devices that someone is trying to log in.

To conclude: This is not a bug - it doesn't reduce security. This is how 2FA systems are generally designed.

-2

Whether it is a bug is arguable. It obviously reduces security.

Suppose I'm a bad guy who sees an Apple device that the owner failed to log out of or lock.  I decide to see what I can get away with.  First thing I try gives me image A (A.jpg). Oh, cool, the owner's keychain will fill in the password for meenter image description here

Two-factor authentication ON THE SAME DEVICE asks me to approve me (the bad guy) sign on to the device.  That's security? (image B). Convenient for the bad guy, who doesn't know where the other devices are.enter image description here

Again, ON THE SAME DEVICE, I am asked to enter a verification code which I can easily do, because it is displayed for me ON THE SAME DEVICE. (image C)enter image description here

Before Apple introduced this design error (yes, my opinion, firmly held), I turned OFF 2FA because I was frequently locked out of my device when the other device was not available.  Unfortunately, sometime since, they decided (another error IMHO) that we are no longer allowed to turn it off.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .