Apple two-step protection won’t protect your data

arstechnica.com

19 points·cramforce··6 comments

What exactly would be the benefit of two-factor if you aren't in physical possession of your device? If someone had your username and password two-factor wouldn't protect you anyway because the code would be sent to it.

Google's two-factor auth has several backup mechanisms: you can print a list of single-use codes[1] or use a backup phone[2].

[1] https://support.google.com/accounts/answer/1187538?hl=en&top... [2] https://support.google.com/accounts/answer/1188780?hl=en&top...

The way Apple's 2FA works is pretty poor and one of the worst I've ever used. Instead of working with an app (Authy, Google Authenticator) they send you a numeric code to your SMS device on file, similar to the way Twitter's 2FA works. Its very clunky and not particularly safe.

I can't understand how Apple could fail this much when a proper solution is pretty well known and easy to implement.

How disappointing, we're at a time where security is a major impact on our lives. Why would they not at least try a little harder to make us feel secure at least a little? Ah well, there's always flip phones.

What is the point of a May 2013 article? Do we believe nothing has changed in between?

Nothing has changed, this is how Apple's 2FA still works. It's relevant because this is how the celebrity hacking happened this weekend: their passwords were brute forced, and they didn't need to break the 2FA as well because it is only needed to make purchases.

Reply on news.ycombinator.com