Macworld:
If you aren’t using two-factor authentication to protect your Apple ID and iCloud account, you really should do it today. Hackers who claim to have millions of stolen iCloud credentials are demanding Apple pay a ransom or they’ll release them—and ZDNet obtained a sample set of credentials and determined they’re real.
But guess what? Using two-factor authentication should protect you completely. It’s easy to set up, so take a minute and do it now.
Do it. Do it now. Yes, it’s inconvenient and a PITA. But one day, you’ll thank me.
The ZDNet article linked from the Macworld article is quite interesting. They got 54 of those credentials (all in UK; the crime group wouldn’t supply credentials for any US victims). All were valid but most were “no longer registered with iMessage.” I wonder what exactly that means? They only reached 10 of the 54 people. What was the deal with the other 44? That’s a lot of people to have stopped using iMessage. The 10 who were reached had used the same passwords since opening their iCloud accounts, except one who said the password in question had been changed 2 years ago, suggesting the breach was between 2011-2015. Some were iPhone-only. Some were Mac/iPad but no iPhone. Some re-used passwords on Facebook and Twitter. Three said their iCloud passwords were unique to iCloud. ZDNet said they can’t explain that, but there have been huge releases of passwords. Probably every attack tries passwords out of those pools, like a dictionary based attack. Also, I hadn’t realized the crime family was based in London. ZDNet has this interesting remark: “[I]t’s evident that the group is naïve and inexperienced. Based on its grandiose claims and its cherry-picking media outlets to cover its claims, it’s also clear that the group is gunning for publicity. When we began asking the group questions, the conversation quickly turned to whether or not CBS News (which like ZDNet is also owned by CBS), would also cover the group’s claims. The group also appears disorganized, and unable to maintain order within its own ranks — seen by the apparent “firing” of one of its members, who ran the Twitter account. It also can’t seem to stay on message, as evidenced by the need to correct the record after reporters “misunderstood the situation.””
I need to revisit this. I set it up months ago but on some occasions when I need to sign out of iCloud and back in it pops up a “Someone at this location (shows my location) is trying to sign in. Allow?” and then gives me a code. The problem is… it shows me this ON THE DEVICE I’M signing in on. Uh… OK, what’s the second factor there?
Google is paying 97$ per hour! Work for few hours and have longer with friends & family! !mj308d:
On tuesday I got a great new Land Rover Range Rover from having earned $8752 this last four weeks.. Its the most-financialy rewarding I’ve had.. It sounds unbelievable but you wont forgive yourself if you don’t check it
!mj308d:
➽➽
➽➽;➽➽ http:/GoogleFinancialJobsCash308MediaFactoryGetPay$97Hour… ★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★:::::!mj308d:….,……
You might have that device saved as the “trusted device” or maybe it’s forwarding your texts from your iPhone.
This is “OK” if you never switch SIM’s. OTP schemes like Google Authenticator are supported by password managers like 1Password, don’t rely on non-sticky verification mechanisms like phone numbers, and integrates well with with OAuth.
I get enough random demands to log into my Apple ID each week without adding this error prone headache.
Me bad. You can use multiple phone numbers.
Maybe. But I just did this on my Mac and it happened. My phone # is trusted and of course I have continuity and handoff on… they’re a major advantage.
In reading the How It Works section on Apple.com, this is designed. However it SHOULD not work on a new device. So, basically, it’s useful in situations like Shawn posted about where someone might have my ID but would be trying to login from a new device. However, it’s useless if they have any of my devices. Of course, if I lose my phone, MacBook, etc then I should disable it as a device and wipe it just to be safe, so… eh.
While I second the “do it now” part, I really do not consider it a PITA at all. It is well implemented (something I would not say about many of Apple’s Cloud services) and has been almost instantaneous so far. As an added bonus, Google has nothing to do with it, so I can even feel safe.
The only somewhat poor part is the activation procedure and its documentation… Don’t remember which article I have used back then, but I certainly did not get it to work following Apple’s instructions.