Escrow Security for iCloud Keychain
support.apple.com
support.apple.com
No. It is unrelated to Apple ID 2FA.
If its what I'm thinking of, it used to be a user-visible thing[1] back in the day.
But now with the need for increased security posture in the modern environment it is now not user visible but held locally and encrypted using the local device secure enclave key. So you would typically now see a prompt for the device password so the enclave can be accessed to access the key to setup/renew iCloud access tokens.
As far as I am aware the only user-visible string still available in the Apple world is (for obvious reasons) the FileVault recovery key on macOS devices. Which is only visible once ... shown to you when you first enable FileVault.
It used to be user-visible, yes, but I wonder if TFA isn’t a little out-of-date, as the UI flow that used to work in order to see this (settings/icloud/keychain/advanced) isn’t there anymore on Mac or iOS. And random poking around indicates that they didn’t move it.
When one would be prompted to create a new code, the dialog said something about “changes to the servers” or something similar. Now, having read TFA, I wonder if that doesn’t mean an HSM got compromised somehow.
I think the point is there are multiple HSMs in multiple locations under the control of different groups of people and a majority of HSMs have to agree...
When you switch to a new device and want to pull iCloud keychain to a new device you need to provide your security code (pin) and additionally a verification code that they send to the phone number.
Nowdays I’m not sure what my security code even is, because it stopped asking for it on a new devices, since you can approve pulling iCloud keychain from another device.
That sounds more like the FileVault recovery key ?
great.