19 ms·

I wish Apple added iMessage as a service to make 2FA more secure.

peruvian 7y ago
I could see Apple offering 2FA as a core feature, at least on iOS. In fact, Apple should redesign Keychain into a user friendly, 1Password-lite product with 2FA built-in (1Password offers this too) or as a separate app that works with Keychain.
- xenospn 7y ago
  Apple has had mandatory device-based 2FA for a while now, but it only works for iCloud logins.
  - oauea 7y ago
    Yes, super annoying. Now I can no longer get into my Apple Developer account without walking to my development mac I use to run xcode builds (for a react native app), since for some bizarre reason the only 2FA they support is their own which requires Apple hardware. It's bad enough their development toolchain requires you to buy their hardware, now to log into their websites you also have to buy their expensive hardware.
    - oezi 7y ago
      Apple continues to support SMS as 2FA. It is a bit hidden when signing in.
      - oauea 7y ago
        I just want TOTP.
- pvg 7y ago
  iCloud Keychain is already a better-than-1Password 1Password-lite and 2FA itself for your Apple id is built into iOS and macOS. I think the limiting thing there is desktop Safari - you don't really notice the full integration unless you're using Safari on macOS as well.
pxeboot 7y ago
Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.
- shawnz 7y ago
  Apple accounts in general also have mandatory SMS 2FA if 2FA is enabled.
- tptacek 7y ago
  Isn't there a registration step for new SIMs with iMessage?
  - balladeer 7y ago
    I think there’s an SMS sent without any visual indication and without asking for explicit permission (or I missed it if there was a tiny text warning). I noticed it when I saw an SMS, in my bill, sent to a Singapore number which, as an international SMS, was changeable (SMS is mostly free here).
- fedorareis 7y ago
  It depends. If your iMessage account is tied to an Apple ID used on multiple devices with 2FA enabled then the code is sent to one of those other devices to validate the login on the new device. So if you are fully in the Apple ecosystem and have 2FA enabled then I believe it would be secure. I know I get alerts on my other devices any time I have had to re-add my phone number to an Apple ID. It tells me my phone number is now being used on another device. So at the very least you would probably be notified.
  - shawnz 7y ago
    When you get the prompt to input the code, just choose "Did not get a verification code" and it will fall back to SMS. See: https://blog.elcomsoft.com/wp-content/uploads/2016/03/apple_2fa-550x341.png https://blog.elcomsoft.com/wp-content/uploads/2016/03/apple_...
mumblemumble 7y ago
I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.
- spydum 7y ago
  What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
  - ridaj 7y ago
    A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
    - ahaseeb 7y ago
      OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
      - madeofpalk 7y ago
        I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.
        7y ago
3fe9a03ccd14ca5 7y ago
Why the downvoting? iMessage is a hundred times more secure than SMS. It’s got E2E encryption and a published security paper. https://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ https://techcrunch.com/2014/02/27/apple-explains-exactly-how...
- xenospn 7y ago
  Unclear.
Nextgrid 7y ago
iMessage still depends on verifying your ownership of a phone number and can be taken over with a SIM swap attack.

I could see Apple offering 2FA as a core feature, at least on iOS. In fact, Apple should redesign Keychain into a user friendly, 1Password-lite product with 2FA built-in (1Password offers this too) or as a separate app that works with Keychain.

xenospn 7y ago
Apple has had mandatory device-based 2FA for a while now, but it only works for iCloud logins.
- oauea 7y ago
  Yes, super annoying. Now I can no longer get into my Apple Developer account without walking to my development mac I use to run xcode builds (for a react native app), since for some bizarre reason the only 2FA they support is their own which requires Apple hardware. It's bad enough their development toolchain requires you to buy their hardware, now to log into their websites you also have to buy their expensive hardware.
  - oezi 7y ago
    Apple continues to support SMS as 2FA. It is a bit hidden when signing in.
    - oauea 7y ago
      I just want TOTP.
pvg 7y ago
iCloud Keychain is already a better-than-1Password 1Password-lite and 2FA itself for your Apple id is built into iOS and macOS. I think the limiting thing there is desktop Safari - you don't really notice the full integration unless you're using Safari on macOS as well.

pxeboot 7y ago

Isn't iMessage just as vulnerable to SIM swapping and number portability fraud as SMS? Once you have control over a phone number, you can register iMessage as that number on a device you control.

shawnz 7y ago
Apple accounts in general also have mandatory SMS 2FA if 2FA is enabled.
tptacek 7y ago
Isn't there a registration step for new SIMs with iMessage?
- balladeer 7y ago
  I think there’s an SMS sent without any visual indication and without asking for explicit permission (or I missed it if there was a tiny text warning). I noticed it when I saw an SMS, in my bill, sent to a Singapore number which, as an international SMS, was changeable (SMS is mostly free here).
fedorareis 7y ago
It depends. If your iMessage account is tied to an Apple ID used on multiple devices with 2FA enabled then the code is sent to one of those other devices to validate the login on the new device. So if you are fully in the Apple ecosystem and have 2FA enabled then I believe it would be secure. I know I get alerts on my other devices any time I have had to re-add my phone number to an Apple ID. It tells me my phone number is now being used on another device. So at the very least you would probably be notified.
- shawnz 7y ago
  When you get the prompt to input the code, just choose "Did not get a verification code" and it will fall back to SMS. See: https://blog.elcomsoft.com/wp-content/uploads/2016/03/apple_2fa-550x341.png https://blog.elcomsoft.com/wp-content/uploads/2016/03/apple_...

mumblemumble 7y ago

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

spydum 7y ago
What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
- ridaj 7y ago
  A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
  - ahaseeb 7y ago
    OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
    - madeofpalk 7y ago
      I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.
      - 7y ago

3fe9a03ccd14ca5 7y ago

Why the downvoting? iMessage is a hundred times more secure than SMS. It’s got E2E encryption and a published security paper. https://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ https://techcrunch.com/2014/02/27/apple-explains-exactly-how...

xenospn 7y ago
Unclear.

Nextgrid 7y ago

iMessage still depends on verifying your ownership of a phone number and can be taken over with a SIM swap attack.