3 ms·

SMS is available as a fallback 2FA method for Apple ID.

gzer0 5y ago
Unfortunately, only one phone number is allowed per Apple ID. And I do not have multiple phone numbers to expend for an SMS only 2fa option here.
- bmarquez 5y ago
  You can have multiple accounts on one "trusted phone number". Trusted phone number is where Apple sends the SMS 2FA code. I have several Apple ID's on 1 phone number. This is different than "Reachable at" phone number which must be unique and is used for iMessage and Facetime, and if it's blank other people can only reach you via iCloud account email. (It makes sense if you think about it, parents setting up iCloud accounts for their children's iPads who might not have their own phone).
- JimDabell 5y ago
  This is not correct. Go to https://appleid.apple.com/account/manage https://appleid.apple.com/account/manage and you will see that you can add multiple trusted phone numbers under Account Security.
m-p-3 5y ago
I only wish they'd support standard TOTP as well, like everyone else.
- sewsuiuldot 5y ago
  I wish they'd let users decide what they want to use as additional factors. I would like to ban phone calls, emails, SMS, and TOTP entirely from all my accounts, especially those that hold credentials for other services, and use only WebAuthn. I'd love to use Apple's keychain for credentials for convenience but it can quickly become the weakest link, when it should be the strongest.
  - PascLeRasc 5y ago
    What’s wrong with TOTP? Isn’t it exactly as secure as WebAuthN?
    - withinboredom 5y ago
      You have to have the generator somewhere to get the code. If it's in software, you must have access to that software, and it must be secure. With WebAuthN, it can be a hardware token and usually multiple of them stored in various locations that only you can access (safe deposit box, physical safe, etc).
    - cubesnooper 5y ago
      TOTP is not as secure as WebAuthn, because if you enter the TOTP code into a phishing site, the phisher can now successfully authenticate as you. WebAuthn was specifically designed to be immune to this case: if you were to use your WebAuthn key in a phishing website, the phisher would not then be able to authenticate as you on the real site.

Unfortunately, only one phone number is allowed per Apple ID. And I do not have multiple phone numbers to expend for an SMS only 2fa option here.

bmarquez 5y ago
You can have multiple accounts on one "trusted phone number". Trusted phone number is where Apple sends the SMS 2FA code. I have several Apple ID's on 1 phone number. This is different than "Reachable at" phone number which must be unique and is used for iMessage and Facetime, and if it's blank other people can only reach you via iCloud account email. (It makes sense if you think about it, parents setting up iCloud accounts for their children's iPads who might not have their own phone).
JimDabell 5y ago
This is not correct. Go to https://appleid.apple.com/account/manage https://appleid.apple.com/account/manage and you will see that you can add multiple trusted phone numbers under Account Security.

m-p-3 5y ago

I only wish they'd support standard TOTP as well, like everyone else.

sewsuiuldot 5y ago
I wish they'd let users decide what they want to use as additional factors. I would like to ban phone calls, emails, SMS, and TOTP entirely from all my accounts, especially those that hold credentials for other services, and use only WebAuthn. I'd love to use Apple's keychain for credentials for convenience but it can quickly become the weakest link, when it should be the strongest.
- PascLeRasc 5y ago
  What’s wrong with TOTP? Isn’t it exactly as secure as WebAuthN?
  - withinboredom 5y ago
    You have to have the generator somewhere to get the code. If it's in software, you must have access to that software, and it must be secure. With WebAuthN, it can be a hardware token and usually multiple of them stored in various locations that only you can access (safe deposit box, physical safe, etc).
  - cubesnooper 5y ago
    TOTP is not as secure as WebAuthn, because if you enter the TOTP code into a phishing site, the phisher can now successfully authenticate as you. WebAuthn was specifically designed to be immune to this case: if you were to use your WebAuthn key in a phishing website, the phisher would not then be able to authenticate as you on the real site.