Hacker News Reader

Comment by 0culus | Hacker News Reader

It's not default, but you can set a recovery key that prevents someone with your phone and passcode from being able to take over your account: https://support.apple.com/en-us/HT208072

View on HN

I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.

Edit: I'm wrong; PIN + device access is game over for everyone, full stop. Preserving the original for posterity:

If what you’re saying is true (resetting an EXISTING recovery key to an attacker controlled recovery key requires only device passcode), that is a major security flaw.

Fundamentally, iOS has made the trade off that most people should default to being able to recover their data if they forget their password. Technical or famous people can and should opt IN to the high security recovery key model.

In other words: if you have set a recovery key, you shouldn’t be able to reset your iCloud password or recovery key without BOTH possession of a secondary logged in Apple device AND the current iCloud password. Alternately, you can of course control the whole shebang with a recovery key, that’s what it’s for.

Are you saying you were able to reset an established recovery key without needing to enter your iCloud password OR 2FA acknowledgement on a secondary device?

Correct. I set a recovery key, force locked the phone (so passcode is required to get back into the phone itself), went to the iCloud security tab as described in the Apple KB article, and proceeded to reset the recovery key. I was only asked for my device passcode.

OK, you're right. The recovery key doesn't do what I thought it was doing. It's not hardening any requirements for 2FA, it's an additional (logical OR), option.

Bummer.

Wait, you have a recovery code today?

I have an "RK-" recovery key in my backup from when I set it up a couple of years ago. However today I see no reference to recovery codes whatsoever, either on my account or during attempts to recover my password. I just now stripped two-factor auth entirely, and set it up again from scratch. There is absolutely no reference to a recovery key anywhere[1].

It must depend on which devices and/or OS versions one is running. I've got a 2013 MacBook Pro on High Sierra and an iPhone 6 on iOS 11 (latest software on both). I also have a confirmed phone number. I no longer have the option for a recovery code with two-factor auth[1].

[1] https://imgur.com/a/pPJe9

Huh, that may be a good point. Both of my Macs are on Sierra and I have and iOS 9 stuck iPad.

It looks like Apple ID "RK-"-prefixed recovery keys are no longer a thing. I have one stored in my backup, but none of the "forgot password" scenarios asks for a recovery key anymore. As a further test, I just stripped two-factor authentication from my account, and set it up from scratch. No mention of a recovery key this time around, and no section for it in the security tab[1].

Recovery keys are gone. You must either have a 2nd device, or be able to receive a text or phone call to a verified phone number. Failing these, the last resort is now an "account recovery" process that takes a few days to reset via what looks like verification by email and confirmation of personal details.

I'd rather have retained the recovery key option, but I imagine this system was removed because the majority of consumers weren't actually storing the key. Of people who at least stored the key, far too many probably only put it on their Apple device(s), which is of course useless.

[1] https://imgur.com/a/pPJe9

   "Remember, if you lose your recovery key, you might be locked out of your Apple ID account permanently."

If you lost your recovery key, you are basically screw yourself out your own account, permanently, period.

Isn't that a caveat with a lot of 2fa systems though? If you get locked out and don't have the recovery keys you got when you set it up, you are basically permanently locked out.

In some cases you can end up doing hilarious things like emailing scanned passports to get it reset. It usually depends on the compromise the provider is willing to make (and the amount they are willing to spend on customer service)

I would love to have systems where I can set a password and there is not online reset available. For my retirement account, for example. If I forget my password, I have to go to an office in person to reset. Maybe a $50 fee, if this service is too much of a burden on the broker. Same with my bank. They have branches everywhere. I know many people forget their passwords all the time, so they need a easy reset for those people, but for others that want a more secure system why not an in-person reset for a fee? Bad PR? News stories about how those greedy banks now want to make money when you forget your password?

Reply on news.ycombinator.com