If you’re in the Apple ecosystem, you may have just gotten a little more secure. The company has now added a two-factor authentication option to to its AppleID system. For those unfamiliar, the AppleID is a single unified identity across iTunes, iCloud, Game Center, Messages, the Mac App Store, and probably another couple things i’m forgetting.
Password security has become a hot topic the last couple of years. As hackers techniques have gotten more elaborate, so have passwords. If you’re not using multiple unique passwords with intertwined capitals, numbers, and characters and changing frequently you’re not as secure as you need to be. However, there is a major drawback here. You can’t possibly remember all those passwords. I have photographic memory and I can’t keep up with them all. You could use a password manager like 1Password or LastPass, and i definitely recommend doing so, but they are still passed on a single method of authentication.
Two-Factor or multi-factor relies on not only the password, but another form of authentication as well. Some two-factor implementations will use questions, but these aren’t much safer if the answers are publicly available on social media. Another form is device and pin based authentication.
This is the kind Apple is using. I’ve used similar two-factors with other services and its much less of a pain that Google’s version of two-factor. When signing up for Apple’s two-factor you register trusted devices. When you access your account, Apple will send you a randomly generated pin in the form of a SMS message. You then enter the pin. If you lose your password, there will be a 14-digit randomly generated key that Apple gives you during the signup process. Don’t lose it because standard reset techniques will be disabled for security reasons.
What this means is that for a little more effort, you will be much more secure. It doesn’t matter if they have your passwords and social engineering attacks would not work. The hackers will literally have to be in possession of your phone. There is one slight downside though, to make sure its actually you, Apple is implementing a 3-way waiting period to make sure its actually you.
Your AppleID has your contact info and most likely one or more forms of payment. I highly recommend you implement two-factor on your AppleID as soon as possible. Click on the link below for instructions.
Apple FAQ: Setting up Apple Two-Factor Authentication.
Must not be set up for Canada yet, I don’t get the option to set it up
Still don’t know why it has to be harder to keep up with passwords than it appears to be for the bad guys to hack your passwords. Many of our team members using twitter seem to get hacked all the time. We need safe and secure single sign-on.