4

If I am not misinformed, the idea of two-factor authentication is that if an attacker somehow gets my Apple ID and password, they have an additional hurdle to overcome.

But it seems to me that this is NOT an obstacle given the behavior shown here:

enter image description here

All I have to do (when it's really me) is drag the pop-up out of the way and copy the number directly. A minor inconvenience, but (so it seems) doesn't keep the intruder out.

Of course, they have to also have one of my devices, but one iPhone disappeared in restaurant in Indiana, another in a subway in Barcelona, and an iPad in Oklahoma (and the same iPad was out of my reach on a train for a night¹).

However, maybe I'm missing something, because Apple seems unconcerned—I reported this as a bug more than sixteen months ago, and there has been no response.

So, am I missing something?

¹When traveling by train in Spain, never take more objects than you can carry.  The train will leave while you are setting down the first load on the platform.

Improve this question
8
  • Also interesting is the words "new device." I use multiple Apple services on this device with the same ID every_day.
    – WGroleau
    Mar 21, 2022 at 22:48
  • Two factor is "something you know, and something you have". You know the password, you have the Mac. This is not a security issue, it's no different than you having your TOTP app running on that same Mac while you try to log in. If you think the codes should be sent somewhere else, configure the somewhere else as a trusted device.
    – Marc Wilson
    Mar 22, 2022 at 1:44
  • 1
    They're all trusted. The code does appear on the others, but it still appears on the one being used. So if they have my password and they have my mac, it's a security problem, unless, as in my question, I'm missing something.
    – WGroleau
    Mar 22, 2022 at 2:48
  • @MarcWilson i have never figured out how to change my trusted devices - i have a mac VM that i do not want to be a trusted device. However, because the vm is logged in to icloud, it automatically became a trusted device. The only way to make it untrusted would be to log it out of icloud, which i would rather not do. This is the same case with a 2011 imac i keep around for display. Is there a way to make devices logged in to icloud yet not trusted? Thanks in advance.
    – anonymousaga
    Mar 22, 2022 at 3:35
  • @WGroleau if someone stole your device, you could use find my to temporarily lock it, preventing any codes/logins from getting there
    – anonymousaga
    Mar 22, 2022 at 3:37

1 Answer 1

Reset to default
2

No, that's not a "hole" in security - this is definitely by design.

The idea behind 2-factor authentication is that a user is required to present 2 separate and different factors of authentication. These factors can be many things, but in Apple's system they are a password (something you know) and a token (something you have) stored on your computer.

This improves security when compared with just authenticating using a single factor, username and password, as was common not so many years ago:

If someone compromises your password and tries to login to your iCloud account from their own computer, they will not be able to login as they cannot produce the 6 digit verification code.

Similarly if someone compromises your authentication token (for example by extracting it from a stolen backup drive) and tries to login to your iCloud account from their own computer, they will not be able to login as they cannot enter the correct account password.

Finally, if someone has physical possession of both one of your trusted devices as well as knowing your iCloud password, they still have one barrier left to pass. For example stealing your iPhone or iPad won't automatically give the thief access to your verification codes - they aren't displayed unless the device is unlocked (using for example TouchID/FaceID or a passcode).

Should someone know your iCloud password, have your device in their possession - and be able to unlock it - then you're out of luck. This is to be expected and is by design.

It is always a good idea to follow simple practices such as:

  • Do not reuse passwords amongst multiple services
  • Do not use the same password for your iCloud account as for your Mac user account or iOS device passcode
  • Use a strong passphrase for your Mac user account - especially if you have your iCloud account password stored in a Keychain in your Mac
  • Enable Find My on compatible devices and ensure that you mark them as missing/stolen as soon as you know that has happened
  • Always keep devices updated with security-related software upgrades

In addition to these practices, it is worth knowing that modern devices usually have the best security. I.e. an 2021 Apple Silicon MacBook Pro will have better security than a 2012 Intel MacBook Pro. Similarly an iPhone 13 Pro will have better security than an iPhone 5S.

Improve this answer
14
  • All correct and all known by me before I asked—except for one paragraph. You implied that Apple DESIGNED what looks like a point of failure which is the particular irritation I asked about.
    – WGroleau
    Mar 22, 2022 at 15:25
  • As far as I know, the only reason a 2012 MBP has poorer security is that it can't run the latest software.
    – WGroleau
    Mar 22, 2022 at 15:28
  • Well, it isn’t really possible for others to know what you know before we write our answers - and they’re not really written only for you. But if you know everything in advance, why ask? And no, it’s not a point of failure - but I guess you already know that.
    – jksoegaard
    Mar 22, 2022 at 17:22
  • In that case you’re misinformed. It’s not just that it cannot run the latest software. The same applies for later models as well.
    – jksoegaard
    Mar 22, 2022 at 17:23
  • I knew what you wrote. I did not know what I asked. What is there about hardware that makes one more secure than another? (Which is really a separate question.)
    – WGroleau
    Mar 22, 2022 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .