Hacker News Reader

Comment by Kwpolska | Hacker News Reader

SMS is available as a fallback 2FA method for Apple ID.

I only wish they'd support standard TOTP as well, like everyone else.

I wish they'd let users decide what they want to use as additional factors. I would like to ban phone calls, emails, SMS, and TOTP entirely from all my accounts, especially those that hold credentials for other services, and use only WebAuthn.

I'd love to use Apple's keychain for credentials for convenience but it can quickly become the weakest link, when it should be the strongest.

What’s wrong with TOTP? Isn’t it exactly as secure as WebAuthN?

TOTP is not as secure as WebAuthn, because if you enter the TOTP code into a phishing site, the phisher can now successfully authenticate as you. WebAuthn was specifically designed to be immune to this case: if you were to use your WebAuthn key in a phishing website, the phisher would not then be able to authenticate as you on the real site.

You have to have the generator somewhere to get the code. If it's in software, you must have access to that software, and it must be secure. With WebAuthN, it can be a hardware token and usually multiple of them stored in various locations that only you can access (safe deposit box, physical safe, etc).

Unfortunately, only one phone number is allowed per Apple ID. And I do not have multiple phone numbers to expend for an SMS only 2fa option here.

You can have multiple accounts on one "trusted phone number". Trusted phone number is where Apple sends the SMS 2FA code. I have several Apple ID's on 1 phone number.

This is different than "Reachable at" phone number which must be unique and is used for iMessage and Facetime, and if it's blank other people can only reach you via iCloud account email.

(It makes sense if you think about it, parents setting up iCloud accounts for their children's iPads who might not have their own phone).

This is not correct. Go to https://appleid.apple.com/account/manage and you will see that you can add multiple trusted phone numbers under Account Security.

Reply on news.ycombinator.com