I logged into iCloud today, and the two factor auth code was sent to the same mac that i logged into iCloud with. My iPhone was right next to me with a full signal, but did not receive the code.

What's the point in that? This seems a bug to me, unless anyone knows any different?

enter image description here

  • AFAIK, TFA codes are sent to all connected iCloud devices. It clearly says "devices" which means any device that's linked to your iCloud account. – Jash Jacob Jun 2 '17 at 10:26
  • 2
    I'm voting to close this question as off-topic because this question is asking how/why Apple does <some thing XYZ> which is defined as what should be avoided asking as defined in the Help Center – Allan Jun 2 '17 at 10:31
  • @JashJacob sure, but surely not the device that you're trying to log in to? What's the point in TFA in that scenario? BTW the code did not go to my iPhone. – MrBliz Jun 2 '17 at 10:34
  • @Allan essentially i'm asking is this a feature or a bug. If it's the latter then i'll file a radar. – MrBliz Jun 2 '17 at 10:35
  • This is a duplicate of this question. However that question doesn't have an accepted answer so I can't close this to the dup. – fsb Jun 2 '17 at 12:58

This is not a bug. The attack that is being prevented here is the case where someone would steal your password and log into your account from their own machine.

So in this case, two factor helps us establish trust by proving that it is in fact you who is trying to log into iCloud and not some attacker who stole only your password. The ways in which we can achieve this can be classified as "something you have", "something you are" and "something you know".

In this case, your password is "something you know". Your iPhone and Mac are both "something you have". Remember, your Mac is signed into iCloud already and is trusted by Apple on system level.

If someone did steal your password (the something you know), they would still require access to either your Mac OR your iPhone. These are both "something you have". As stated previously, your Mac is already trusted by Apple, so presenting this two factor code on your Mac is no less secure than presenting it on your iPhone. For an attack to be successful, the attacker would have to steal your password as well as obtain access to one of your trusted devices (your Mac or iPhone). So two factor is just as valid being presented on your phone as on your Mac.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged .