19

I would like to add non-SMS, non-Apple multi-factor authentication to my Apple ID.

1Password TOTP

I'm most interested in using a "code generator"-type Time-based One-Time Password (TOTP) based on RFC 6238 implemented by client apps such as:

  • Google Authenticator
  • Microsoft Authenticator
  • Yubico Authenticator
  • Authy
  • 1Password
  • LastPass
  • etc.

I do not see any such option. Is this type of authentication available for Apple ID?

I would also be interested in adding YubiKey or other similar hardware "security keys". Or any other non-SMS, non-Apple multi-factor solutions.

Note: I am able to add Apple's proprietary "two-factor authentication for Apple ID" integrated within iOS and macOS as an alternative to SMS-based "two-step verification". This question is asking instead for a 3rd-party-compatible two-factor mechanism that does not involve using an Apple device signed in to iCloud.

Related:

Improve this question
3
  • 5
    I second your request. It is indeed a shame that apple implemented the way they did. Mostly apple would orient you to 2FA based on a 2nd apple device which is crasy unreliable, when you are stuck with a lost device or broken device...
    – Guy
    Jun 1, 2019 at 9:28
  • 3
    In 2021 Apple still doesn't adopt open industry standards like TOTP for authentication, and they claim to be at the forefront of security and ease-of-use. This is quite disappointing.
    – Manchineel
    Feb 7, 2021 at 13:52
  • 1
    I was surprised by this as well. I thought Apple was supposed to be ahead of the game on security yet falls back to woefully insecure SMS-based 2FA if you don't want to use an Apple device for it. Security, but only if you pay us!
    – Iguananaut
    Apr 15, 2021 at 15:01

2 Answers 2

Reset to default
14

No, you cannot use TOTP-authentication as implemented by for example Google Authenticator (i.e. RFC6238) with Apple-ID. The only supported system is Apple's own system, which works very similarly to TOTP.

This hasn't got anything to do with the SMS-requirement at all.

As a collary to the above, hardware-based OATH-TOTP solutions such as a YubiKey won't work with Apple-IDs either.

Starting next year, Apple is going to start supporting hardware Security Keys. The supported keys are physical, and they communicate with an iPhone or iPad over Lightning, USB-C or NFC.

Those keys are not TOTP-based, and so you will still not be able to use the listed third party app authenticators, such as Google Authenticator or Microsoft Authenticator.

It is currently unclear whether Apple will allow using Security Keys only on Apple devices (such as iPhone and iPads) - or it will be generally available on desktop computers as well. Your request for a third party solution that does not require an iPhone or iPad means that it is still unclear whether a third party hardware solution could be used at all - even if the requirement of it being TOTP-based was removed.

Improve this answer
0
2

Apple has announced that starting in "early 2023," security keys will be available for iCloud.

However, there is no indication this will support non-physical security keys. The screenshots Apple has provided clearly show a requirement to insert/tap your key, rather than to setup a code-generating app.

It is likely that the SMS requirements could be waived if one of these were to be set up, but that is not known at this time.

Security Keys

Apple introduced two-factor authentication for Apple ID in 2015. Today, with more than 95 percent of active iCloud accounts using this protection, it is the most widely used two-factor account security system in the world that we’re aware of. Now with Security Keys, users will have the choice to make use of third-party hardware security keys to enhance this protection. This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government. For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key as one of the two factors. This takes our two-factor authentication even further, preventing even an advanced attacker from obtaining a user’s second factor in a phishing scam.

Improve this answer
3
  • The security keys that Apple supports are not TOTP-based, which is what this question is about. So they are not relevant here. You cannot use the app authenticators mentioned in the question with the new Apple security key functionality.
    – jksoegaard
    Dec 9, 2022 at 13:25
  • @jksoegaard While true that the OP is asking specifically about TOTP, the title does not make that distinction and I made it clear in my response that TOTP was still unavailable. However, for some people TOTP is not required.
    – Ezekiel
    Dec 9, 2022 at 14:13
  • 1
    This is a welcome development and I see it as a +1 as moving away from Apple's current TFA and prior two step implementations will help with real live security scenarios that OP is likely to care about even if they didn't phrase the question to anticipate this roll out.
    – bmike ♦
    Dec 9, 2022 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .