iCloud.com Now Utilizing Two-Factor Authentication

[digitalove]

Not working for me: once I log into iCloud.com I can access my apps without any extra login.

Should I enable this two-factor authentication or maybe the roll out isn't done yet?

 

[cire]

My naked selfies are safe!

That's what you think! Btw, please workout a little more before your next round of nude selfies. >;-)

 

[PinkyMacGodess]

http://en.wikipedia.org/wiki/SecurID

Blizzard uses RSA for their authentication system.

Nope, they use Vasco.

 

[camnchar]

This has been working for MONTHS!!

I noticed it a while ago when I logged in months ago. This isn't news, this is just a feature that hasn't been reported on yet.

The whole iCloud "break in" is the dumbest piece of reporting I've seen in a while.

They used a password like, "PASSWORD" or "passw0rd" or "Pass123" or something equally dumb. This is a story about idiots and their bad passwords, not about Apple. Ugh, pisses me off.

Easy passwords, maybe. Apple is on the hook for never notifying the celebs in question that there were multiple failed attempts at logging in under their user name, allowing the criminals to keep trying, over and over, until they broke through. Two-factor authentication should prevent that from happening again, even if a criminal guesses (or uses a program to find) an easy password.

 

[collegitdept]

Couldn't they just go to a token system, something active that generates a number, like the Blizzard token fob. It would make sense to use that as an option. They could call it the iToken, and license it for other companies to use too...

Blizzard calls them 'Authenticators'...

View attachment 492159

I did work a job that used the RSA SecureID tokens. It was funny that people sticky noted their passwords on the back of them all the time...

This IS a token system. Only that the 4 digit passcode is sent to a phone via a Push Notification.

This is better since most don't have token generators and are expensive. Also the user must have the token generator on person at all times to login.

 

[camnchar]

That's what you think! Btw, please workout a little more before your next round of nude selfies. >;-)

I've been hacked!

 

[PinkyMacGodess]

This IS a token system. Only that the 4 digit passcode is sent to a phone via a Push Notification.

This is better since most don't have token generators and are expensive. Also the user must have the token generator on person at all times to login.

$6.50 for the Blizzard 'Authenticators'...

AND the 'Authenticator' could be an app too...

 

[ipoppy]

So...in other words Apple admit had weak iCloud protection?

 

[C64]

Not working for me: once I log into iCloud.com I can access my apps without any extra login.

Should I enable this two-factor authentication or maybe the roll out isn't done yet?

Yes, you need to enable two-step verification in order for two-step verification to work...

 

[PinkyMacGodess]

So...in other words Apple admit had weak iCloud protection?

Anything that relies on 'users' is going to be weak. No matter WHAT you do...

 

[bmms8]

Yes, you need to enable two-step verification in order for two-step verification to work...

How can i proceed with this? thanks,

 

[SMIDG3T]

I'd like to enable this, but am wondering...

Does it do the two factor EVERY TIME? Or does it place a cookie on your computer so that you don't have to do it again unless you change computers (or delete the cookie)?

My bank uses two factor, but it remembers each device so you only have to use it when logging in from a new device.

You can check "Remember This Browser" and as long as you use the same computer and funnily enough the same browser you won't need to this every time.

 

[revanmj]

Access to iCloud.com apps like Mail, Contacts, Calendar, Reminders, Pages, Numbers, and Keynote is restricted until the verification code is entered on the website, but Find My iPhone remains accessible.

So you still can wipe a device remotely without a one-time authorization code?

 

[Primejimbo]

How can i proceed with this? thanks,

here is how to set it up
http://support.apple.com/kb/HT5570

 

[jlake02]

Glad to see this again. I'd much rather have a text to my phone for auth.

 

[PinkyMacGodess]

Apple *could* use RSA, and have the tokens imprinted with their logo.

That would be cool...

They could also buy RSA from EMC and that would lower the price a lot...

 

[Keeval]

How can i proceed with this? thanks,

To add two-step authentication to your Apple Account:

http://support.apple.com/kb/HT5570?viewlocale=en_US&locale=en_US

You need to be in a supported country though.

 

[bmms8]

To add two-step authentication to your Apple Account:

http://support.apple.com/kb/HT5570?viewlocale=en_US&locale=en_US

You need to be in a supported country though.

here is how to set it up
http://support.apple.com/kb/HT5570

Thank you both!

 

[UnfetteredMind]

Apple needs to get the two factor rolled out everywhere and make it mandatory.

 

[spectrumfox]

Good, good.

 

[PinkyMacGodess]

Blizzard uses the Vasco Digipass Go 6 and at the prices Blizzard charged originally, I can't think they made much, if any, money off selling them, but after their huge hacking incident, it made sense...

Some might think it extreme, but wait until YOU are hacked.

I like the impression of security that a token gives people. I think pretty soon, with the way things are going, we will all have one implanted at birth...

 

[LV426]

$6.50 for the Blizzard 'Authenticators'...

AND the 'Authenticator' could be an app too...

Rubbish idea. It's madness to think of lugging around a 2FA fob when an iPhone will do exactly the same job. As well as a lot of other things like... being a smartphone.

 

[collegitdept]

Apple needs to apply this most importantly to iCloud backups!

 

[PinkyMacGodess]

Rubbish idea. It's madness to think of lugging around a 2FA fob when an iPhone will do exactly the same job. As well as a lot of other things like... being a smartphone.

But the communication to the iPhone can be hacked too. And what if you're not in an area where you can get a message?

Apple *could* use an app to generate tokens too...

----------

Apple needs to apply this most importantly to iCloud backups!

Yeah, finding out that the backups weren't protected was like finding out that there really IS a Santa Clause and he won't be coming this year...

 

[newagemac]

Doesn't this go too far in the other direction though? I have used iCloud.com in the past when traveling (and don't have phone service) to access my email on a public computer, etc. Now if I don't have my device *and* have service I am screwed?

Don't ever access your accounts on a public computer. You're just asking for problems. I either use my phone or my laptop or tablet. If I have none of those I just don't login. I survived without internet before and I just make sure I'm never without a personal device with access if it is important.

----------

So you still can wipe a device remotely without a one-time authorization code?

Not going to do anyone any good since you still need the username and password to access the iCloud account when setting the wiped device back up.