4 ms·
2FA with SMS was a standout weird choice from Apple. I hope they discourage that quickly with a better alternative.
by noja 8y ago
2FA with SMS was a standout weird choice from Apple. I hope they discourage that quickly with a better alternative.
- xoa 8y agoYeah, maybe it's just a bow to practicality but if anything mildly surprised regardless because they've gotten quite serious about their own HSM implementation which is slowly starting to spread to more and more new Macs, and it's effectively universal under iOS. I sort of expected given initial thrusts like Apple Pay that they'd push hardware token usage way harder, with either direct support for Macs with T-series chips already or else some tie-in to iDevices. Ideally NitroStick/Yubikey/etc would come along for the ride and Apple would work towards a framework that could be used with other HSMs beyond their own, but at this point I'd take any major platform trying to move crypto auth forward over passwords/sms/anything else at all.
- chrisfinazzo 8y agoI think your first instinct is correct, here. While they probably would feel safer if everybody was using Google Auth, Authy, or a physical device, it gets around people having to explicitly copy tokens around which, IIRC has been abused a fair bit in order to steal credentials.
- PascLeRasc 8y agoThey do 2FA for iCloud sign-in through an vanilla iOS prompt, not SMS afaik.