9 ms·

iOS's 2FA model confuses the hell out of me. I'm sure if I sat down and worked it all out I could figure out what all Apple is using for 2FA on my iDevices, bu

iOS's 2FA model confuses the hell out of me. I'm sure if I sat down and worked it all out I could figure out what all Apple is using for 2FA on my iDevices, but I haven't been arsed to do that and it shouldn't be this complicated. With iOS's 2FA system : I've had to click buttons on other devices. Enter codes on other devices. Enter codes from other devices. Click links in emails. Type my passcode on other devices. I just ... don't have a grasp on it at all. That's not good. With regards to the backup issues outlined in the article, it's hard to say if the backup leak is a major issue. Take the casual user: They won't be making iTunes backups. Most casual users are probably just doing iCloud backups. In fact, they don't do backups at all; iCloud backups are automatic so they don't think about it (it just works). Take the security hard user: They'll have a password instead of a passcode on the device. So adversaries probably won't get access anyway. Of course, it's possible they shoulder-skim your password, whereas they probably won't be able to ever shoulder-skim your backup password. So certainly Apple's change here _does_ objectively make the system weaker. It's hard to say if what Apple did here was the right thing. Like I said, I don't think most casual users are doing iTunes backups, so why even bother making iTunes backups more user friendly? Regardless, it could certainly be improved. Maybe require 2FA to reset backup password? The issue where you can reset the iCloud password is certainly troubling. It's a hard issue to balance, as Apple doesn't want to set up a system where the average user gets locked out of their account because they forgot their password. But it really shouldn't be possible to take a single iDevice and password and take over a user's iCloud account.

0culus 9y ago
It's not default, but you can set a recovery key that prevents someone with your phone and passcode from being able to take over your account: https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072
- 0culus 9y ago
  I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.
  - mercutio2 9y ago
    Edit: I'm wrong; PIN + device access is game over for everyone, full stop. Preserving the original for posterity: If what you’re saying is true (resetting an EXISTING recovery key to an attacker controlled recovery key requires only device passcode), that is a major security flaw. Fundamentally, iOS has made the trade off that most people should default to being able to recover their data if they forget their password. Technical or famous people can and should opt IN to the high security recovery key model. In other words: if you have set a recovery key, you shouldn’t be able to reset your iCloud password or recovery key without BOTH possession of a secondary logged in Apple device AND the current iCloud password. Alternately, you can of course control the whole shebang with a recovery key, that’s what it’s for. Are you saying you were able to reset an established recovery key without needing to enter your iCloud password OR 2FA acknowledgement on a secondary device?
    - 0culus 9y ago
      Correct. I set a recovery key, force locked the phone (so passcode is required to get back into the phone itself), went to the iCloud security tab as described in the Apple KB article, and proceeded to reset the recovery key. I was only asked for my device passcode.
      - mercutio2 9y ago
        OK, you're right. The recovery key doesn't do what I thought it was doing. It's not hardening any requirements for 2FA, it's an additional (logical OR), option. Bummer.
  - developer2 9y ago
    Wait, you have a recovery code today? I have an "RK-" recovery key in my backup from when I set it up a couple of years ago. However today I see no reference to recovery codes whatsoever, either on my account or during attempts to recover my password. I just now stripped two-factor auth entirely, and set it up again from scratch. There is absolutely no reference to a recovery key anywhere[1]. It must depend on which devices and/or OS versions one is running. I've got a 2013 MacBook Pro on High Sierra and an iPhone 6 on iOS 11 (latest software on both). I also have a confirmed phone number. I no longer have the option for a recovery code with two-factor auth[1]. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9
- devy 9y ago
  "Remember, if you lose your recovery key, you might be locked out of your Apple ID account permanently." If you lost your recovery key, you are basically screw yourself out your own account, permanently, period.
  - 0culus 9y ago
    Isn't that a caveat with a lot of 2fa systems though? If you get locked out and don't have the recovery keys you got when you set it up, you are basically permanently locked out.
    - Ntrails 9y ago
      In some cases you can end up doing hilarious things like emailing scanned passports to get it reset. It usually depends on the compromise the provider is willing to make (and the amount they are willing to spend on customer service)
      - njarboe 9y ago
        I would love to have systems where I can set a password and there is not online reset available. For my retirement account, for example. If I forget my password, I have to go to an office in person to reset. Maybe a $50 fee, if this service is too much of a burden on the broker. Same with my bank. They have branches everywhere. I know many people forget their passwords all the time, so they need a easy reset for those people, but for others that want a more secure system why not an in-person reset for a fee? Bad PR? News stories about how those greedy banks now want to make money when you forget your password?
- developer2 9y ago
  It looks like Apple ID "RK-"-prefixed recovery keys are no longer a thing. I have one stored in my backup, but none of the "forgot password" scenarios asks for a recovery key anymore. As a further test, I just stripped two-factor authentication from my account, and set it up from scratch. No mention of a recovery key this time around, and no section for it in the security tab[1]. Recovery keys are gone. You must either have a 2nd device, or be able to receive a text or phone call to a verified phone number. Failing these, the last resort is now an "account recovery" process that takes a few days to reset via what looks like verification by email and confirmation of personal details. I'd rather have retained the recovery key option, but I imagine this system was removed because the majority of consumers weren't actually storing the key. Of people who at least stored the key, far too many probably only put it on their Apple device(s), which is of course useless. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9
FreakyT 9y ago
Completely agree about Apple's 2-factor implementation being completely ridiculous. If you don't have an iPhone it gets even weirder -- I've had it pop up auth codes on the same laptop on which I'm logging into iCloud.
- dannyw 9y ago
  Your laptop may be trusted, your browser isn't.
- pfranz 9y ago
  :shrug: it makes sense to me for icloud.com Your laptop is trusted, but the browser you're using isn't. AFAIK there's no browser API for a trusted OS to bless a web browser and web request so this is kind of a workaround. Safari has the possibility of doing this without standards support--I don't know if it does. Pet-peeve, but I wouldn't say ridiculous. It's like how there's no Kerberos compatibility for web apps.
  - hmahncke 9y ago
    Could you walk through that threat model? I don't quite get it. In what scenario is an antagonist in control of my (untrusted) browser but not also in control of my (trusted) laptop? Put another way, doesn't that antagonist always see the 2fa code, and then enter it?
    - pfranz 9y ago
      Your browser doesn't know the laptop is trusted. I'm not aware of any standard API that a browser would use to confirm they're running on a trusted laptop (they'd have to implement an OS specific call for an OS specific feature...which doesn't often happen). In theory Safari could support it (I don't know if it does or doesn't). Apple could push for either a standards body or just Chrome/Firefox to implement macOS APIs--but I don't see any reason those browsers would make the effort.
- fpgaminer 9y ago
  Even better: I've had it pop up the auth codes on my laptop, but iCloud didn't actually ask for them.
kccqzy 9y ago
Maybe it’s just me but I’ve tried and failed several times to restore an iCloud backup. A backup isn’t a real backup unless the restoration is tested. Unfortunately iCloud backups would just never finish restoring for my device, whereas restoring iTunes backups just works. So I usually set up a recurring calendar item to remind myself to backup to my computer (which then get backed up again using Time Machine and CCC). It’s sad that I have to do this.
- spike021 9y ago
  Odd. I recently switched iPhones and successfully restored from an iCloud backup. YMMV, I guess.
- princekolt 9y ago
  They're just very slow, and at least until iOS 10, apps that were in the "restoring" state displayed no indication of such. I was told by an Apple retail employee that in most cases WhatsApp was always the last app to finish restoring, which was exactly the app that was "stuck" for me. I assume it is because the iPhone is decrypting the backup, but it's just that it is doing it very slowly for some reason.
- epx 9y ago
  Happened with my kid's phone too. Had to settle with an older backup that I had made manually via iTunes.
- thinkythought 9y ago
  i've found it absolutely will not complete(especially photos) unless a charger is connected to the device. this completely stumped me with a fully charged phone recently they need to add a "keep going anyways" button, or a prompt to plug in like the watch has

0culus 9y ago

It's not default, but you can set a recovery key that prevents someone with your phone and passcode from being able to take over your account: https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072

0culus 9y ago
I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.
- mercutio2 9y ago
  Edit: I'm wrong; PIN + device access is game over for everyone, full stop. Preserving the original for posterity: If what you’re saying is true (resetting an EXISTING recovery key to an attacker controlled recovery key requires only device passcode), that is a major security flaw. Fundamentally, iOS has made the trade off that most people should default to being able to recover their data if they forget their password. Technical or famous people can and should opt IN to the high security recovery key model. In other words: if you have set a recovery key, you shouldn’t be able to reset your iCloud password or recovery key without BOTH possession of a secondary logged in Apple device AND the current iCloud password. Alternately, you can of course control the whole shebang with a recovery key, that’s what it’s for. Are you saying you were able to reset an established recovery key without needing to enter your iCloud password OR 2FA acknowledgement on a secondary device?
  - 0culus 9y ago
    Correct. I set a recovery key, force locked the phone (so passcode is required to get back into the phone itself), went to the iCloud security tab as described in the Apple KB article, and proceeded to reset the recovery key. I was only asked for my device passcode.
    - mercutio2 9y ago
      OK, you're right. The recovery key doesn't do what I thought it was doing. It's not hardening any requirements for 2FA, it's an additional (logical OR), option. Bummer.
- developer2 9y ago
  Wait, you have a recovery code today? I have an "RK-" recovery key in my backup from when I set it up a couple of years ago. However today I see no reference to recovery codes whatsoever, either on my account or during attempts to recover my password. I just now stripped two-factor auth entirely, and set it up again from scratch. There is absolutely no reference to a recovery key anywhere[1]. It must depend on which devices and/or OS versions one is running. I've got a 2013 MacBook Pro on High Sierra and an iPhone 6 on iOS 11 (latest software on both). I also have a confirmed phone number. I no longer have the option for a recovery code with two-factor auth[1]. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9
devy 9y ago
"Remember, if you lose your recovery key, you might be locked out of your Apple ID account permanently." If you lost your recovery key, you are basically screw yourself out your own account, permanently, period.
- 0culus 9y ago
  Isn't that a caveat with a lot of 2fa systems though? If you get locked out and don't have the recovery keys you got when you set it up, you are basically permanently locked out.
  - Ntrails 9y ago
    In some cases you can end up doing hilarious things like emailing scanned passports to get it reset. It usually depends on the compromise the provider is willing to make (and the amount they are willing to spend on customer service)
    - njarboe 9y ago
      I would love to have systems where I can set a password and there is not online reset available. For my retirement account, for example. If I forget my password, I have to go to an office in person to reset. Maybe a $50 fee, if this service is too much of a burden on the broker. Same with my bank. They have branches everywhere. I know many people forget their passwords all the time, so they need a easy reset for those people, but for others that want a more secure system why not an in-person reset for a fee? Bad PR? News stories about how those greedy banks now want to make money when you forget your password?
developer2 9y ago
It looks like Apple ID "RK-"-prefixed recovery keys are no longer a thing. I have one stored in my backup, but none of the "forgot password" scenarios asks for a recovery key anymore. As a further test, I just stripped two-factor authentication from my account, and set it up from scratch. No mention of a recovery key this time around, and no section for it in the security tab[1]. Recovery keys are gone. You must either have a 2nd device, or be able to receive a text or phone call to a verified phone number. Failing these, the last resort is now an "account recovery" process that takes a few days to reset via what looks like verification by email and confirmation of personal details. I'd rather have retained the recovery key option, but I imagine this system was removed because the majority of consumers weren't actually storing the key. Of people who at least stored the key, far too many probably only put it on their Apple device(s), which is of course useless. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9

FreakyT 9y ago

Completely agree about Apple's 2-factor implementation being completely ridiculous. If you don't have an iPhone it gets even weirder -- I've had it pop up auth codes on the same laptop on which I'm logging into iCloud.

dannyw 9y ago
Your laptop may be trusted, your browser isn't.
pfranz 9y ago
:shrug: it makes sense to me for icloud.com Your laptop is trusted, but the browser you're using isn't. AFAIK there's no browser API for a trusted OS to bless a web browser and web request so this is kind of a workaround. Safari has the possibility of doing this without standards support--I don't know if it does. Pet-peeve, but I wouldn't say ridiculous. It's like how there's no Kerberos compatibility for web apps.
- hmahncke 9y ago
  Could you walk through that threat model? I don't quite get it. In what scenario is an antagonist in control of my (untrusted) browser but not also in control of my (trusted) laptop? Put another way, doesn't that antagonist always see the 2fa code, and then enter it?
  - pfranz 9y ago
    Your browser doesn't know the laptop is trusted. I'm not aware of any standard API that a browser would use to confirm they're running on a trusted laptop (they'd have to implement an OS specific call for an OS specific feature...which doesn't often happen). In theory Safari could support it (I don't know if it does or doesn't). Apple could push for either a standards body or just Chrome/Firefox to implement macOS APIs--but I don't see any reason those browsers would make the effort.
fpgaminer 9y ago
Even better: I've had it pop up the auth codes on my laptop, but iCloud didn't actually ask for them.

kccqzy 9y ago

Maybe it’s just me but I’ve tried and failed several times to restore an iCloud backup. A backup isn’t a real backup unless the restoration is tested. Unfortunately iCloud backups would just never finish restoring for my device, whereas restoring iTunes backups just works. So I usually set up a recurring calendar item to remind myself to backup to my computer (which then get backed up again using Time Machine and CCC). It’s sad that I have to do this.

spike021 9y ago
Odd. I recently switched iPhones and successfully restored from an iCloud backup. YMMV, I guess.
princekolt 9y ago
They're just very slow, and at least until iOS 10, apps that were in the "restoring" state displayed no indication of such. I was told by an Apple retail employee that in most cases WhatsApp was always the last app to finish restoring, which was exactly the app that was "stuck" for me. I assume it is because the iPhone is decrypting the backup, but it's just that it is doing it very slowly for some reason.
epx 9y ago
Happened with my kid's phone too. Had to settle with an older backup that I had made manually via iTunes.
thinkythought 9y ago
i've found it absolutely will not complete(especially photos) unless a charger is connected to the device. this completely stumped me with a fully charged phone recently they need to add a "keep going anyways" button, or a prompt to plug in like the watch has