4 ms·

I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.

by 0culus 9y ago

mercutio2 9y ago
Edit: I'm wrong; PIN + device access is game over for everyone, full stop. Preserving the original for posterity: If what you’re saying is true (resetting an EXISTING recovery key to an attacker controlled recovery key requires only device passcode), that is a major security flaw. Fundamentally, iOS has made the trade off that most people should default to being able to recover their data if they forget their password. Technical or famous people can and should opt IN to the high security recovery key model. In other words: if you have set a recovery key, you shouldn’t be able to reset your iCloud password or recovery key without BOTH possession of a secondary logged in Apple device AND the current iCloud password. Alternately, you can of course control the whole shebang with a recovery key, that’s what it’s for. Are you saying you were able to reset an established recovery key without needing to enter your iCloud password OR 2FA acknowledgement on a secondary device?
- 0culus 9y ago
  Correct. I set a recovery key, force locked the phone (so passcode is required to get back into the phone itself), went to the iCloud security tab as described in the Apple KB article, and proceeded to reset the recovery key. I was only asked for my device passcode.
  - mercutio2 9y ago
    OK, you're right. The recovery key doesn't do what I thought it was doing. It's not hardening any requirements for 2FA, it's an additional (logical OR), option. Bummer.
developer2 9y ago
Wait, you have a recovery code today? I have an "RK-" recovery key in my backup from when I set it up a couple of years ago. However today I see no reference to recovery codes whatsoever, either on my account or during attempts to recover my password. I just now stripped two-factor auth entirely, and set it up again from scratch. There is absolutely no reference to a recovery key anywhere[1]. It must depend on which devices and/or OS versions one is running. I've got a 2013 MacBook Pro on High Sierra and an iPhone 6 on iOS 11 (latest software on both). I also have a confirmed phone number. I no longer have the option for a recovery code with two-factor auth[1]. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9
- 0culus 9y ago
  Huh, that may be a good point. Both of my Macs are on Sierra and I have and iOS 9 stuck iPad.

I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.

by 0culus 9y ago

I must stand corrected; I just tried setting it up. To set a new recovery key, all you need is the passcode.

Edit: I'm wrong; PIN + device access is game over for everyone, full stop. Preserving the original for posterity: If what you’re saying is true (resetting an EXISTING recovery key to an attacker controlled recovery key requires only device passcode), that is a major security flaw. Fundamentally, iOS has made the trade off that most people should default to being able to recover their data if they forget their password. Technical or famous people can and should opt IN to the high security recovery key model. In other words: if you have set a recovery key, you shouldn’t be able to reset your iCloud password or recovery key without BOTH possession of a secondary logged in Apple device AND the current iCloud password. Alternately, you can of course control the whole shebang with a recovery key, that’s what it’s for. Are you saying you were able to reset an established recovery key without needing to enter your iCloud password OR 2FA acknowledgement on a secondary device?

0culus 9y ago
Correct. I set a recovery key, force locked the phone (so passcode is required to get back into the phone itself), went to the iCloud security tab as described in the Apple KB article, and proceeded to reset the recovery key. I was only asked for my device passcode.
- mercutio2 9y ago
  OK, you're right. The recovery key doesn't do what I thought it was doing. It's not hardening any requirements for 2FA, it's an additional (logical OR), option. Bummer.

developer2 9y ago

Wait, you have a recovery code today? I have an "RK-" recovery key in my backup from when I set it up a couple of years ago. However today I see no reference to recovery codes whatsoever, either on my account or during attempts to recover my password. I just now stripped two-factor auth entirely, and set it up again from scratch. There is absolutely no reference to a recovery key anywhere[1]. It must depend on which devices and/or OS versions one is running. I've got a 2013 MacBook Pro on High Sierra and an iPhone 6 on iOS 11 (latest software on both). I also have a confirmed phone number. I no longer have the option for a recovery code with two-factor auth[1]. [1] https://imgur.com/a/pPJe9 https://imgur.com/a/pPJe9

0culus 9y ago
Huh, that may be a good point. Both of my Macs are on Sierra and I have and iOS 9 stuck iPad.