Hacker News Reader

Comment by throwaway45901 | Hacker News Reader

I just found out all new iCloud accounts require your mobile number for 2FA.

A friend is in a study abroad program and broke his iPhone. He bought a new one but can’t access his account because he no longer has a “trusted device” (his broken iPhone) to verify his login and since he’s overseas, can’t get the fallback SMS.

He basically has to wait until he returns.

View on HN

So he set up 2 factor authentication, does not have access to one of the factors and now he can’t login? How is that Apples fault?

Note that you can also set it up to call you instead of sending texts; I presume he can take calls otherwise I don’t understand why he even took a phone with him.

He did not set up 2FA willingly. It is now required for all new Apple accounts.

He tried to find a way to disable it, but it is no longer possible.

If Apple had a 2FA method where he could use another email, that would have solved the problem. Or even using an app like Authy or Google Authenticator.

He is overseas, with no global roaming, and so is unable to receive calls or texts.

He took his phone because he planned on getting a local SIM card.

You can actually add more than one number so he could have added a family members or friends number. He might also be able to use the recovery procedure from this link to regain access after a waiting period:

https://support.apple.com/en-us/HT204921

Yes, if he had known this would happen, he could have done all those things.

Or if Apple did not force 2FA on new accounts, then this also wouldn’t have happened.

But they do and for very good reasons. Too bad your friend got caught in the cracks but it’s his own fault.

> since he’s overseas, can’t get the fallback SMS

This is one of the reasons I purchased a mobile/cell number from Twilio to use as a backup for all of the websites that only support 2FA via SMS (Apple, PayPal etc.).

The 2FA code gets sent to a channel on my own private Slack workspace via a webhook [1]. If I lose my phone I can always log into the Slack website on another device to access the code.

[1] https://www.twilio.com/docs/studio/tutorials/how-to-post-sms...

Have you tested that it works?

According to this other recent HN comment, Twilio numbers cannot be used for SMS verification. Banks and Gmail are mentioned:

https://news.ycombinator.com/item?id=19219150

"I have this problem because my main, personal number is actually a twilio number (as I built my own personal telco within twilio) and this means I cannot receive validation messages from shortcodes (like a bank)."

> Have you tested that it works?

Yes. I wouldn't have mentioned it if it didn't work.

Here's a screenshot showing the Apple and PayPal 2FA codes I have received through Slack via Twilio...

https://i.imgur.com/bQYSbPZ.png

I also don't have any accounts with banks that are stupid enough to use SMS for 2FA [1] so I haven't needed to use my Twilio number for that purpose.

Using SMS for Gmail 2FA doesn't make any sense when Google supports U2F.

[1] https://motherboard.vice.com/en_us/article/mbzvxv/criminals-...

paypal also supports TOTP through an old trick. Look it up.

I tried to find the "old trick" but only end up on 404s or forum threads that end with "they must have closed that trick now".

Would you mind sharing a working source?

Perhaps they have close it now then. This was the source: https://medium.com/@dubistkomisch/set-up-2fa-two-factor-auth...

As further proof that I am not lying here's a screenshot from my Twilio messaging log...

https://i.imgur.com/6b3cg5L.png

62226 = PayPal and 51472 = Apple.

It's not shortcodes per se, those work fine for the most part.

Twilio/Google Voice (more generally, VOIP numbers) are explicitly being blocked (because it's possible to find out what type of number it is) at a number of services, likely to combat fraud.

I've found MSFT (Azure) and AWS to be recent examples of such services. Google itself does the same.

Apple's 2FA makes things much simpler for users who own multiple Apple devices (very easy to authorize a new iPhone from your iMac or iPad) but if you only have one, it's next to impossible to use reliably. You can't make a backup or use a third-party 2FA client, or a non-Apple device. They don't provide "traditional" TOTP two-factor authentication that you could use in many different TOTP-based authenticator programs.

edit: Mercifully, they at least allow you to enter the 'find my iPhone' section without needing the 2FA code.

It happened to me when I changed country and phone number, I couldn't identified my iCloud account.

I just follow the instructions on the login page that I did not have my device with me, and just entered my Recovery Key that was given to me when I setup 2FA.

It's as simple as that.

Mind you I use a password manager and keep all my login information in it.

Note that the “recovery key” is for the older “2 step verification.”

The newer “2 factor verification” does not have a recovery key.

I lost my Uber account since it got re-associated with a temporary prepaid SIM I used when traveling once, so now I'm cut off from 2FA. 2FA is a nightmare for users, but all the alternatives are worse.

> since he’s overseas, can’t get the fallback SMS

Why?

Probably opted to buy a local SIM instead of using the one from his home country

Many service providers don't support roaming at all - especially on pre-paid accounts.

Many service providers silently fail to deliver SMS when one is roaming internationally, especially if not on a post-paid account

I think this must be a US thing, never heard of it in Europe.

He doesn’t have international roaming.

I'm not sure that there is a subscription in Europe that doesn't include international roaming. At least I can't remember seeing one here in Norway. I suppose Europeans travel from country to country a lot more on average.

Reply on news.ycombinator.com