4 ms·
I just found out all new iCloud accounts require your mobile number for 2FA. A friend is in a study abroad program and broke his iPhone. He bought a new one bu
by throwaway45901 8y ago
I just found out all new iCloud accounts require your mobile number for 2FA.
A friend is in a study abroad program and broke his iPhone. He bought a new one but can’t access his account because he no longer has a “trusted device” (his broken iPhone) to verify his login and since he’s overseas, can’t get the fallback SMS.
He basically has to wait until he returns.
- kwhitefoot 8y ago> since he’s overseas, can’t get the fallback SMS Why?
- jen20 8y agoMany service providers don't support roaming at all - especially on pre-paid accounts.
- tnorthcutt 8y agoProbably opted to buy a local SIM instead of using the one from his home country
- cbhl 8y agoMany service providers silently fail to deliver SMS when one is roaming internationally, especially if not on a post-paid account
- kwhitefoot 8y agoI think this must be a US thing, never heard of it in Europe.
- throwaway45901 8y agoHe doesn’t have international roaming.
- kwhitefoot 8y agoI'm not sure that there is a subscription in Europe that doesn't include international roaming. At least I can't remember seeing one here in Norway. I suppose Europeans travel from country to country a lot more on average.
- yohannparis 8y agoIt happened to me when I changed country and phone number, I couldn't identified my iCloud account. I just follow the instructions on the login page that I did not have my device with me, and just entered my Recovery Key that was given to me when I setup 2FA. It's as simple as that. Mind you I use a password manager and keep all my login information in it.
- throwaway45901 8y agoNote that the “recovery key” is for the older “2 step verification.” The newer “2 factor verification” does not have a recovery key.
- kalleboo 8y agoI lost my Uber account since it got re-associated with a temporary prepaid SIM I used when traveling once, so now I'm cut off from 2FA. 2FA is a nightmare for users, but all the alternatives are worse.
- elagost 8y agoApple's 2FA makes things much simpler for users who own multiple Apple devices (very easy to authorize a new iPhone from your iMac or iPad) but if you only have one, it's next to impossible to use reliably. You can't make a backup or use a third-party 2FA client, or a non-Apple device. They don't provide "traditional" TOTP two-factor authentication that you could use in many different TOTP-based authenticator programs. edit: Mercifully, they at least allow you to enter the 'find my iPhone' section without needing the 2FA code.
- arthurfm 8y ago> since he’s overseas, can’t get the fallback SMS This is one of the reasons I purchased a mobile/cell number from Twilio to use as a backup for all of the websites that only support 2FA via SMS (Apple, PayPal etc.). The 2FA code gets sent to a channel on my own private Slack workspace via a webhook [1]. If I lose my phone I can always log into the Slack website on another device to access the code. [1] https://www.twilio.com/docs/studio/tutorials/how-to-post-sms-to-slack https://www.twilio.com/docs/studio/tutorials/how-to-post-sms...
- jlokier 8y agoHave you tested that it works? According to this other recent HN comment, Twilio numbers cannot be used for SMS verification. Banks and Gmail are mentioned: https://news.ycombinator.com/item?id=19219150 https://news.ycombinator.com/item?id=19219150 "I have this problem because my main, personal number is actually a twilio number (as I built my own personal telco within twilio) and this means I cannot receive validation messages from shortcodes (like a bank)."
- arthurfm 8y ago> Have you tested that it works? Yes. I wouldn't have mentioned it if it didn't work. Here's a screenshot showing the Apple and PayPal 2FA codes I have received through Slack via Twilio... https://i.imgur.com/bQYSbPZ.png https://i.imgur.com/bQYSbPZ.png I also don't have any accounts with banks that are stupid enough to use SMS for 2FA [1] so I haven't needed to use my Twilio number for that purpose. Using SMS for Gmail 2FA doesn't make any sense when Google supports U2F. [1] https://motherboard.vice.com/en_us/article/mbzvxv/criminals-hackers-ss7-uk-banks-metro-bank https://motherboard.vice.com/en_us/article/mbzvxv/criminals-...
- bubblethink 8y agopaypal also supports TOTP through an old trick. Look it up.
- 8y ago
- tinus_hn 8y agoSo he set up 2 factor authentication, does not have access to one of the factors and now he can’t login? How is that Apples fault? Note that you can also set it up to call you instead of sending texts; I presume he can take calls otherwise I don’t understand why he even took a phone with him.
- throwaway45901 8y agoHe did not set up 2FA willingly. It is now required for all new Apple accounts. He tried to find a way to disable it, but it is no longer possible. If Apple had a 2FA method where he could use another email, that would have solved the problem. Or even using an app like Authy or Google Authenticator. He is overseas, with no global roaming, and so is unable to receive calls or texts. He took his phone because he planned on getting a local SIM card.
- tinus_hn 8y agoYou can actually add more than one number so he could have added a family members or friends number. He might also be able to use the recovery procedure from this link to regain access after a waiting period: https://support.apple.com/en-us/HT204921 https://support.apple.com/en-us/HT204921
- throwaway45901 8y agoYes, if he had known this would happen, he could have done all those things. Or if Apple did not force 2FA on new accounts, then this also wouldn’t have happened.
- tinus_hn 8y agoBut they do and for very good reasons. Too bad your friend got caught in the cracks but it’s his own fault.