6 ms·
One thing that worries me about iCloud is that it puts a lot of data and services behind one single password. Said password is therefor used a lot, with a lot
by rickmb 14y ago
One thing that worries me about iCloud is that it puts a lot of data and services behind one single password.
Said password is therefor used a lot, with a lot of chances for interception. But most of all, it's used for trivial matters in which password typing is a nuisance (installing a cheap iPhone app), which pretty much invites people to use a weak, easy to type password.
iCloud should have multiple, completely separate forms of authentication for services like Find My Mac, instead of using the same login for wiping all your Apple hardware as you use to download Angry Birds...
- mileswu 14y agoPerhaps it should ask an additional security question or passphrase for 'dangerous' operations like remote wipe. Two-factor authentication (using say your phone like Google) wouldn't work however because typically it's your phone that is stolen and you are trying to wipe.
- Jach 14y agoYou could use something besides a phone for 2-factor authentication--e.g. YubiKey.
- c16 14y agoGoogle + Yubikey would be great. Google + 2 step authentication + Yubikey would be a dream (and a bit over-kill?)
- justincormack 14y agoIt seems to work with some limitations as the yubikey has no time source. http://binaryelysium.com/blog/2011/12/13/a-reluctant-relationship-yubikey-google-authentication.html http://binaryelysium.com/blog/2011/12/13/a-reluctant-relatio...
- nl 14y agoGoogle + 2 step authentication Did you mean 2 factor authentication? Google + 2 step authentication + Yubikey Is there any reason why you can't do this? It seems like it would work? (I've never used Yubikey so I might be missing something)
- superchink 14y agoGoogle actually calls it "2-step verification" source: http://support.google.com/accounts/bin/answer.py?hl=en&answer=180744 http://support.google.com/accounts/bin/answer.py?hl=en&a...
- radicalbyte 14y agoThat's why google let you use multiple phone numbers to verify. Lose your main phone? No problem, login to your account using the two factor code from your landline (or partner's phone).
- TazeTSchnitzel 14y agoSame reason why I worry about Google Accounts. Your email, contacts, calendar, location, phone security, documents, files, music, videos, games, apps, credit card details, merchant account, search history, web app hosting, etc., all on one account.
- nl 14y agoTurn on 2-factor auth. I thought about it and worried about it and thought about it some more, and finally did it. And I had no problems at all - it works really well.
- deleted 14y ago[deleted]
- klodolph 14y agoDedicated attackers routinely bypass two-factor auth. If your second factor is your phone, then they simply attack via the phone carrier first.
- adrianmsmith 14y agoIndeed: http://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication-was http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...
- laurencei 14y agowhilst this might be true - I get the feeling this is more of a "targeted attacked" - rather than a target of opportunity. 2factor is surely one of the best options we currently have to secure ourselves?
- novakinblood 14y agoI agree. I think there was deliberate focus on the victim based on everything they accomplished.
- 16s 14y agoI agree. For years I have believed that "Single Sign On is Single Compromise", but users and auditors love it.
- lostlogin 14y agoThat damn account password kills me. A single password which you have to enter heaps of times on iOS. If having one password meant you only entered it once id cope, but its for email, iCloud, imessage, home sharing music, home sharing video, notes, find my phone, AppStore. It's so slow to set a device up, especially if you have a decent pasword. I wish they would fix it.
- nicky0 14y agoYou can use a different Apple ID for the App Store that you use for iCloud, on the same device.
- lostlogin 14y agoI know. But if I could enter it once as some kind of 'log into everything' option it would be great. It's so annoying to do on phone, iPad, laptop, appletv etc that I change my password too rarely as its so painful. Nasty aftershocks too (oh, so I have to find the appletv remote i to enable my account so that I can accept my phone as the remote).