Apple Expanding Two-Step Verification to iCloud.com

[MacRumors]

Apple appears to be testing its two-factor authentication system on some iCloud.com accounts, asking for a verification code before allowing users with two-factor verification enabled to access various iCloud.com apps.

First noticed by AppleInsider, the two-factor verification system for iCloud.com requires users to enter a verification code sent via SMS or to a trusted iOS device before the iCloud.com versions of Mail, Contacts, Calendar, Reminders, Pages, Numbers, and Keynote can be used.

Previously, accessing these apps only required an Apple ID password, but now "Find My iPhone" is the only app that remains accessible without a two-factor verification code. Computers used to access iCloud.com have a "Remember This Browser" option, requiring a verification code to be entered only once.

Originally implemented back in March of 2013, two-factor verification is an opt-in system designed to increase Apple ID account security by requiring identity verification before allowing users to make account changes or purchase content on new devices. It replaces standard security questions with a security code delivered to a trusted device.

At this time, it is unknown if Apple is simply testing the feature with some users or working on a wider rollout for all iCloud.com users with two-factor verification enabled.

Update 3:30 PM PT: Apple appears to have disabled two-factor verification for some iCloud.com accounts that previously had access to the feature, suggesting it may have seen an accidental early launch.

Article Link: Apple Expanding Two-Step Verification to iCloud.com

 

[TouchMint.com]

I can hardly remember my password let alone the secert question haha.

 

[SMIDG3T]

This is good, it's needed to view/edit your Apple ID so why not to access iCloud?

Another layer of security is great.

 

[madsci954]

Tested on live account and it shows up for me.

 

[S.B.G]

This is a step in the right direction. I've implemented the two-step on my Apple ID and think it would be welcome on iCloud as well.

 

[borneo76]

i just frequently use Find My iPhone app only, that's all what i need . But this is good to make more secure

 

[shokk]

I can confirm this was requested on my account when I logged into iCloud. It's only a 4-digit PIN, but better than nothing.

 

[rorschach]

All I can say is, it's about time.

 

[OreoMuncher]

All well and good but...

How on earth am i going to use this is school. Our school uses a cart of windows laptops and we have separate computer rooms. And obviously since I'm in school i can't use my phone... What am i going to do? Will there be an option to turn this off? I physically can't use word or powerpoint in school any more, it's too much of a headache, i really need access to iCloud. Oh god.

 

[anyjungleinguy]

Am I interpreting this correctly?

but now "Find My iPhone" is the only app that remains accessible without a two-factor verification code.

Even with 2 factor authentication, an attacker only needs a user's password to log into iCloud.com and then precede to wipe devices from Find My iPhone?

 

[appleguy123]

I hope it's optional. I often use icloud to email things to myself to print at my college. Not interested in have to do this every time I need to print something.

 

[Oletros]

Please, Apple, use an standard system like TOTP used by almost all the other companies

 

[Primejimbo]

I hope it's optional. I often use icloud to email things to myself to print at my college. Not interested in have to do this every time I need to print something.

then check "remember this browser". I just tried it and it took an extra few seconds.

 

[coolfactor]

I hope it's optional. I often use icloud to email things to myself to print at my college. Not interested in have to do this every time I need to print something.

Why not employ a service like Dropbox? Just as easy to log into that as to log into iCloud.

 

[CrazyForApple]

the more secure, the better

 

[SMIDG3T]

How on earth am i going to use this is school. Our school uses a cart of windows laptops and we have separate computer rooms. And obviously since I'm in school i can't use my phone... What am i going to do? Will there be an option to turn this off? I physically can't use word or powerpoint in school any more, it's too much of a headache, i really need access to iCloud. Oh god.

"Computers used to access iCloud.com have a "Remember This Browser" option, requiring a verification code to be entered only once."

Surely this means you can login at home, tick the box and you won't be asked for a code again so you can continue using iCloud at school?

 

[rdlink]

"Computers used to access iCloud.com have a "Remember This Browser" option, requiring a verification code to be entered only once."

Surely this means you can login at home, tick the box and you won't be asked for a code again so you can continue using iCloud at school?

I think the OP's point is that their school uses a series of computers on carts, and they won't necessarily have access to the same computer every time. Also, many schools like this clear browser history automatically on logout.

 

[appleguy123]

then check "remember this browser". I just tried it and it took an extra few seconds.

Because the college's library has several computers and it's not guaranteed that I'll get the same one every time?

Plus, I think they're restored to defaults every night.

 

[whsbuss]

WOW - I suggested this to Apple feedback when the phones down under got hacked last month. Its what'e required in this hacker world we live in.

Good job Apple!

 

[Born Again]

Take my social!

 

[bushido]

I can hardly remember my password let alone the secert question haha.

lol my family will never understand this .... they already dont get those security questions. my sister for example is always like "huh??? how does it know what my favorite book is????" and my aunt is like "what is an apple id? ... after putting in her gmail account info for like 5 times and getting her apple id blocked"

 

[bathurstguy]

Am I interpreting this correctly?



Even with 2 factor authentication, an attacker only needs a user's password to log into iCloud.com and then precede to wipe devices from Find My iPhone?

It makes sense not to require second factor authentication for FMiP. If you have lost your iPhone, then how are you going to retrieve the code sent to your iPhone... You really need to think before posting!

Also, worst case if your device is erased, you simply restore from iCloud Backup and change your password. It really isn't that bad TBH.

 

[firedept]

This is a good thing. In this day and age, the more security the better. I won't be surprised though by how many people will not use it unless they have no option out of it.

 

[riskerin]

issue forseen?

What does one do, however, if you are logging onto another computer to iCloud, so you can use Find my iPhone to locate that trusted IOS device they would normally send the verification code to?

 

[CFreymarc]

How on earth am i going to use this is school. Our school uses a cart of windows laptops and we have separate computer rooms. And obviously since I'm in school i can't use my phone... What am i going to do? Will there be an option to turn this off? I physically can't use word or powerpoint in school any more, it's too much of a headache, i really need access to iCloud. Oh god.

Forbidding access to cell phones in the class room is an obsolete policy trying to defend a nearly obsolete educational system over a century old propped up by teachers unions. There is a middle ground to make this work but the teach has to know they are no longer the sole provider of information in the classroom anymore. That went away with a broadband connection into the schools.