How to Enable Two-Step Verification for Apple ID

[Mtmspa]

It should be possible to log onto Apple devices without Touch ID, IE, Macs, by using Touch ID on a iPhone autopaired over Bluetooth or wifi.

So what about 4s, 5 and 5c owners?

 

[ArtOfWarfare]

So what about 4s, 5 and 5c owners?

What about the people who own Android phones? Or no phones at all?

Obviously they continue using passwords like the cavemen they are. For the rest of us (of which I imagine you are probably one), Apple should have done away entirely with the need for passwords by now.

 

[tennisproha]

Question. So say you lost your trusted devices and you need to login to iCloud.com to use find my phone to find said devices. What do you do now?

 

[iMerik]

You don't see how?

Say I'm logging into any internet service on a PC, I log in with my username only and then the server sends a request via Apple to my verified iOS devices (iPhone in my case) that I have to touch the fingerprint sensor to complete the login.

That would be great, no? Very simple. And also quite simple to add extra security layers for those who don't trust the sensor alone.

But Touch ID replaces the need to type in a password, it isn't designed to act as and replace a two-step verification step like a time-based or one-time-generated code.

You asked, "Wasn't the iPhone's fingerprint scanner supposed to do away with passwords?" You didn't ask, "Wasn't Touch ID supposed to become the second factor in a multifactor authentication solution?" I see a difference; maybe I'm wrong.

 

[iMerik]

Question. So say you lost your trusted devices and you need to login to iCloud.com to use find my phone to find said devices. What do you do now?

Good question. You'll see when you log in that iCloud says you can still find your phone without needing to enter the two-step code. You'll also notice there is no padlock on Find My iPhone in iCloud.

 

[tennisproha]

Good question. You'll see when you log in that iCloud says you can still find your phone without needing to enter the two-step code. You'll also notice there is no padlock on Find My iPhone in iCloud.

aaah! Thats the apple I know and love. Good forethought.

 

[mw360]

But Touch ID replaces the need to type in a password, it isn't designed to act as and replace a two-step verification step like a time-based or one-time-generated code.

You asked, "Wasn't the iPhone's fingerprint scanner supposed to do away with passwords?" You didn't ask, "Wasn't Touch ID supposed to become the second factor in a multifactor authentication solution?" I see a difference; maybe I'm wrong.

I'm sorry I don't understand what you're saying. I offered a design scenario where TouchID could replace the need for passwords and simultaneously provide multi factor authentication. I only offered it because you said you couldn't see how that could be possible. I'm not really sure why you're rejecting it now.

 

[iMerik]

I'm sorry I don't understand what you're saying. I offered a design scenario where TouchID could replace the need for passwords and simultaneously provide multi factor authentication. I only offered it because you said you couldn't see how that could be possible. I'm not really sure why you're rejecting it now.

I wasn't rejecting your new idea; I was simply pointing out what you said in your original post about it replacing passwords and then how you switched over to wanting it to replace multifactor authentication. Those are different discussions in my mind.

In regards to your new design scenario, I imagine it has a lot to do with the security concerns around accepting data from outside sources during the authentication process. There are probably man-in-the-middle concerns with your design. iCloud can push a code out to an iPhone without much security concern, because you are viewing the code on a device you have in your hand and then typing it back in your computer, a separate device. If you allow devices to check your Touch ID and then send a signal back to iCloud for the multifactor, now Apple has to worry about code injection vulnerabilities and MitM attacks where the confirmation being sent back to iCloud may not actually be your iPhone & Touch ID.

That's my guess anyway... could be way off. It's a little more like you are proposing, in terms of not dealing with these pesky codes, when authenticating iCloud Keychain on your phone. If your phone is an iOS trusted device, you pick it during authentication and then your phone receives the code and immediately accepts the code without forcing you to enter it manually. This is how I hoped FaceTime and iMessage would have worked instead of requiring an app-specific password.