4 ms·
What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is abs
by shortcake27 3y ago
What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.
- ec109685 3y agoMy guess is that they aren’t making things less secure. There are flows that let you reset your password but don’t let you login today, so letting you login via those flows would be a step up in usability. If you don’t have your phone as your second factor or can’t use phone today to reset password, then I don’t expect you’ll be able to login via that mechanism.
- shortcake27 3y agoAh yeah that’s true, it’s no less secure than recovery via phone number. Not entirely sure how to prevent recovery using a phone number. I wonder if this means setting up a recovery key instead? Been considering doing this anyway. https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072
- amanzi 3y agoIt's true - I have to use SMS as second factor to log into iCloud. Apple don't let you use a generic OTP as MFA - the only other option is to get a notification on your iPhone or iPad. I don't have an iPhone and I rarely have my iPad with me, so SMS is the only way I can log in to icloud.com.