3 ms·

> 1. Even with 2FA active, Apple will, apparently every couple of years, make you answer the security questions you gave when you first set the account up. One

by twtwtw 5y ago

> 1. Even with 2FA active, Apple will, apparently every couple of years, make you answer the security questions you gave when you first set the account up. One might question the usefulness of that feature, since after a few years one may have forgotten the answer when it is clear that one might have to answer it some day in the case one lost access to one's account by usual means. Maybe things are different with Apple, but on other systems, the questions are usually simple enough that good acquaintances might be able to answer them (eg, "parent's place of birth" or some such). In a sense, one wouldn't expect an acquaintance to steal a device, thus one may accept the weakness of those questions. If one choose to use a contrived answer for that feature, one reduces the risk of someone guessing it, but at the same time it might make it harder to remember it when it matters. I don't really believe that Apple is at fault here.

fhd2 5y ago
That's saying I shouldn't have forgotten the answers in the first place - which is a fair point I suppose. What bothers me is that there _is_ a process for resetting the question in case you've forgotten them, but that very process requires you to know them.
- twtwtw2 5y ago
  (Same person, different throwaway, cannot prove it though) > What bothers me is that there _is_ a process for resetting the question in case you've forgotten them, but that very process requires you to know them. I'll be honest and tell you that I tend to forget the answer to these questions, simply because I don't want to use a simple question/answer set which could be guessed by someone else, but if I use a more elaborate answer, then I am bound to forget it after a while (essentially what happened to you), so clearly I also find this system painful, but I don't see how this could be improved. Unless, somehow a physically unique token (like an ID card, or a biometric feature) would be used instead of passwords, but not every device nowadays has the ability to handle them, and even them it raises the question of how it could be exploited, or how to handle the terrible case of one losing access to that token.

by twtwtw 5y ago

fhd2 5y ago

That's saying I shouldn't have forgotten the answers in the first place - which is a fair point I suppose. What bothers me is that there _is_ a process for resetting the question in case you've forgotten them, but that very process requires you to know them.

twtwtw2 5y ago
(Same person, different throwaway, cannot prove it though) > What bothers me is that there _is_ a process for resetting the question in case you've forgotten them, but that very process requires you to know them. I'll be honest and tell you that I tend to forget the answer to these questions, simply because I don't want to use a simple question/answer set which could be guessed by someone else, but if I use a more elaborate answer, then I am bound to forget it after a while (essentially what happened to you), so clearly I also find this system painful, but I don't see how this could be improved. Unless, somehow a physically unique token (like an ID card, or a biometric feature) would be used instead of passwords, but not every device nowadays has the ability to handle them, and even them it raises the question of how it could be exploited, or how to handle the terrible case of one losing access to that token.