Third-Party Apps Will Need App-Specific Passwords for iCloud Access From June 15

Discussion in 'MacRumors.com News Discussion' started by MacRumors, May 16, 2017.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    [​IMG]
    App-specific passwords are set to become a mandatory requirement for third-party apps that access iCloud user data, according to an Apple Support email sent out today.

    Currently, app-specific passwords are used to allow non-native apps like email clients to sign in to iCloud accounts that are protected by two-factor authentication. The security measure ensures that users can still link up their iCloud account to apps and services not provided by Apple, while also avoiding the need to disclose their Apple ID password to third parties.

    However, app-specific passwords will become a basic requirement from June 15, according to Apple. The policy change basically means that users who want to continue using third-party apps with their iCloud account will have to enable two-factor authentication and generate individual passwords for each app.
    Two-factor authentication ensures that you're the only person who can access your Apple account, even if someone knows your password. To turn it on from any iOS device running iOS 10.3 or later, open the Settings app, tap your name at the top, and then tap Password & Security.

    If you're using iOS 10.2 or earlier, you can enable it from Settings -> iCloud -> Apple ID -> Password & Security. If you're on a Mac, go to System Preferences -> iCloud -> Account Details, click Security, and enable two-factor authentication from there.

    To generate an app-specific password, sign into your Apple ID account page (https://appleid.apple.com), go to App-Specific Passwords under Security, and click Generate Password.

    Article Link: Third-Party Apps Will Need App-Specific Passwords for iCloud Access From June 15
     
  2. macfacts macrumors 68000

    macfacts

    Joined:
    Oct 7, 2012
    Location:
    Cybertron
  3. Chupa Chupa macrumors G5

    Chupa Chupa

    Joined:
    Jul 16, 2002
    #3
    That's all fine but it's get confusing and frustrating for the nontechnically oriented user -- and even those of us who are. If Apple really wants to beef up security I don't understand why it doesn't allow keychain access to apps and also require devs to allow TouchID. The best way to ensure security is to encourage people to use long unique random passwords for every app. But you need a password manager to do this and right now Apple's only works in Safari, not apps.

    TouchID is available for apps, but not mandated. It should be mandated and keychain access should be made available for devices that do not have TouchID. That would be truly usable feature and set more space between iOS and Android. I mean if Apple is really serious about user security.
     
  4. strategicthinke macrumors member

    strategicthinke

    Joined:
    Feb 6, 2014
    Location:
    Rio de Janeiro
    #4
    This is terrible.
    I live in a country where I can easily get my iPhone robbed. If I am without my mobile number (if it's stolen) does this mean I am locked out of my iCloud?
     
  5. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #5
    Awful change, makes my computing life more difficult. I think I'll be sure to avoid iCloud as much as possible. I don't want to be forced to use 2 factor. I had turned that on a couple of months ago, and it was just a nightmare trying to use. I don't know why but with multiple iOS and OS X devices, it just didn't work as I had hoped.
     
  6. j-beda macrumors newbie

    Joined:
    Jun 23, 2004
    #6
    I have found 2-factor auth difficult to support for a large fraction of my clients. Most of them do not use 3rd party apps that this would effect as far as I know, but I guess I will soon find out.

    I suspect Apple is going to be spending a lot of resources on their support system. I guess that is good for the local economies of places that Apple's call centres are in.
     
  7. kmj2318 macrumors 65816

    kmj2318

    Joined:
    Aug 22, 2007
    Location:
    Naples, FL
    #7
    Well I hope they find a way to make it much easier to manage.

    Why not just make it the default instead of mandatory?
     
  8. mdellepi macrumors member

    Joined:
    Jun 15, 2015
    Location:
    Italy
    #8
    It's good. But this "app specific password" thing must be stated clearly. Some weeks ago I was trying to set up the Windows 10 Mail app of a friend to receive iCloud mail (and calendar,...) and his credentials were not working. Only after long search I understood that I should have put an app specific password (something I was completely unaware of) instead of the general iCloud one...
     
  9. Nem macrumors member

    Joined:
    Dec 2, 2008
    #9
    I accidentally changed to two factor auth a while back and had to use these app specific passwords, hated it, it seemed to work for about a week and then stop stating the password was incorrect and had to set up another one each time. After three times I turned two factor auth off and went back to normal. I can see me finally moving away from apple email entirely as it's just not worth the hassle.
     
  10. JGRE macrumors 6502a

    JGRE

    Joined:
    Oct 10, 2011
    Location:
    Dutch Mountains
    #10
    If you live in a country were can get robbed easily, you should be happy with two-factor authentication. Now only you phone gets robbed, otherwise also your data :)
    Btw, they steel your phone not your number.
     
  11. itsmilo macrumors 6502a

    itsmilo

    Joined:
    Sep 15, 2016
    Location:
    Europe
    #11
    Oh god, no one in my family understands anything above a password as it is. Not even security questions "wtf how does it know where i was born? Thats creepy"
     
  12. sk1wbw macrumors 68040

    sk1wbw

    Joined:
    May 28, 2011
    Location:
    Williamsburg, Virginia
    #12
    This is such a ****ing pain in the ass. What's the point of having passwords then? Such a damn pain to have to go into Apple's website, create a ****ing password for everything on top of the password that you already have for that same thing.
     
  13. Kilibee macrumors newbie

    Kilibee

    Joined:
    Oct 12, 2016
    Location:
    Munich
    #13
    Does anybody have more detailed information or a link to the details of this change?

    As this stands now, there are many open questions…
     
  14. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #14
    I got an email, and it states nothing more then the news article.
     
  15. sk1wbw macrumors 68040

    sk1wbw

    Joined:
    May 28, 2011
    Location:
    Williamsburg, Virginia
    #15
    That's my whole point. If you have a strong password, what difference does the platform you're using the app on make?
     
  16. MR-LIZARD macrumors member

    Joined:
    Jan 9, 2012
    Location:
    UK
    #16
    This is already available and has been since iOS 8! The uptake from developers is so low. I have one App (ASOS) that actually uses the API to access the Safari keychain's credentials.

    I have contacted lots of the developers of the apps I use to add this as a feature request but it just doesn't seem to have priority, despite it seeming easy to implement.

    References:

    https://9to5mac.com/2014/06/13/ios-...ri-autofill-credentials-for-quick-easy-login/

    https://developer.apple.com/reference/security/shared_web_credentials
     
  17. Otelm macrumors newbie

    Otelm

    Joined:
    Nov 18, 2013
    #17
    Just to clarify: this only affects apps that access iCloud web services in a non-native way (web API). E.g. those mentioned: outlook, thunderbird, and similar. I'm a developer and I used to have only one such app, which has recently been updated to iCloud drive instead.

    This change won't affect apps which use iCloud Drive, keychain (which is already accessible by devs btw, they just don't implement it) and apps which use the CloudKit framework. CloudKit already assigns app-specific containers to apps, while this change only affects services which want to access iCloud outside of their own space (which makes sense, if you consider the security risks).

    A kind suggestion: please enable two-factor authentication, the risks in using a single password nowadays are just too great, whatever platform you use.
     
  18. tweak25 macrumors newbie

    Joined:
    Jan 12, 2014
    #18
    So this only affects third party Mail, contact and calendar apps?

    If I have to generate a password for every app that syncs with my iCloud, it's going to be a major pain!
     
  19. Otelm macrumors newbie

    Otelm

    Joined:
    Nov 18, 2013
    #19
    Yep, only for (example) contact and calendar apps which needs "enlarged" or "outside" access to iCloud. Absolutely not all apps, that would indeed be insane.
     
  20. mdellepi macrumors member

    Joined:
    Jun 15, 2015
    Location:
    Italy
    #20
    I think the problem is that 3rd party apps cannot "summon" the two-factor authentication. So, in principle, if they worked just by putting the general Apple credentials, they would circumvent that additional security check. This way, you must insert a password that you can generate only by using something (the Apple website) that can be accessed only after the two-factor check. It's a way to push two-factor authentication also when it is not directly available.
     
  21. Fixey macrumors newbie

    Fixey

    Joined:
    May 16, 2017
    #21
    --- Post Merged, May 16, 2017 ---
    Apple Connect app for iOS is not compatible when you turn this two step authentication on, need to disable else Connect app is restricted
     
  22. IPadNParadise, May 16, 2017
    Last edited: May 16, 2017

    IPadNParadise macrumors regular

    IPadNParadise

    Joined:
    Jan 12, 2013
    #22
    As an older, semi non-techy, I am encountering my first confusion in setting this up. I went into my appleid settings and found where I could create an app generated request for a password. I entered my userid and then my own chosen password (unique for this), hit enter and it responded "here is your password" giving me one it created for me. Now, that's fine, it's just that Apple has never chosen my password for me when I am setting things up. Soooo, is their "created for me" going to work come the day I need it or will I be locked out of the app? I did record both my chosen one and "theirs" but...

    ETA: came back to say now Apple has sent me an email acknowledging that I have set this up and included the password that I entered vs the one that popped back to me (theirs) during setup. So now even more confusing. First place, I dont remember Apple sending me back an acknowledgement email showing a password I have selected for something!
     
  23. Mascots macrumors 65816

    Mascots

    Joined:
    Sep 5, 2009
    #23
    If an app stores your password for a nefarious use, that app wouldn't actually have access to your Apple ID - only iCloud through that facet.

    You'd also be able to disable that one key without having to reset your passwords everywhere -and- if that key was lost and seeded somewhere you didn't want, you'd know exactly what app was loose with it.

    Though it's a pain, it's a system being forced on you because other people (maybe even you!) are too irresponsible with their passwords and iCloud accounts are just too valuable and have too much control over a persons Apple ecosystem.
     
  24. macchelsea macrumors newbie

    Joined:
    Jan 23, 2010
    Location:
    Hong Kong
    #24
    If two-factor authentication works as planned I would welcome this change. But I've tried setting up at least 3 times in the past just to get HomeKit working, but every time at least one device couldn't get the activation code. And all those app-specific passwords are just plain stupid.
     
  25. itguy06 macrumors 6502

    Joined:
    Mar 8, 2006
    #25
    Enpass is free on the desktop, works in all browsers, and is a few $$ for mobile (iOS/Android/Windows)
     

Share This Page