Slashdot Mirror
Apple Drops Recovery Key From Two-Factor Authentication In New OS Versions
eggboard writes: If you've ever turned on what's now called "two-step verification" for an Apple ID, you had to create a Recovery Key. Lose this 14-digit code and have your password reset (because of hacking attempts against you), and you might lose access forever to purchases and data, as Owen Williams almost did. Apple confirmed today that starting with its public betas of OS X 10.11 and iOS 9, two-factor authentication won't have a Recovery Key. Instead, if you have to reset a password or lose access to devices, you'll have to go through an account verification process with human beings.
No, really, this isn't someone that's just stolen their bag at an airport.
If I encrypt something and lose my key, I should lose my data. But this policy is about authentication (i.e. proving your identity) and not encryption. They're different things, except for some reason they are almost always conflated.
I don't understand what you're saying (or alternately, it just doesn't make sense). If anything, this accomplishes the opposite. If the recovery key was a strict technical requirement to access the account information, and Apple doesn't possess that key, then Apple would have the ability to tell the government, "Sorry, there's nothing we can do". If they replace the requirement of a key with a human being employed by Apple, then certainly they lose that ability.
In general, 2-factor authentication doesn't really have anything to do with whether or not the company has access to your data. It's only affects how difficult it is for an unauthorized user to get access. Apple could happily make themselves an authorized user though by just making sure they have the encryption keys to everything and only using 2-factor on the client to gate access to the keys for a user.
But if this affects governments' ability to request data at all, they're *adding* a "back-door" method of access here, not removing one.
I was under the assumption that the one time recovery code was likely stored as a hash somewhere? Surely it's harder to guess or obtain then somebody ringing up and pretending to be you.
I mean with the current system the feds either have to put in a request (and have some kind of paper trail) or spend time, money and invest in some infrastructure to do it off the books. Now they'll just have to get your date of birth, address and phone number and pay some homeless guy $5 to impersonate you - all to steal your iTunes library that just contains that U2 album you didn't want in the first place!
but who would've guessed smartphones would take us there?
considering the company's logo, the whole mark of the beast thing just seems to fit.
Oh humans! You mean the weakest link in the security chain?
cuz only haxx0rz k4n d0 haxxin
Some random guy in the internet has a hack attempt on his account get blocked by his use of 2 factor ID. Instead of being grateful the guy complains on twitter that he is too busy to have correctly backed the recovery key he was warned he was would have to safeguard.
Clearly, Apple's procedures up to now avoided having the backdoor of saving the recovery key. That was OUR responsibility. Not saving it meant that Apple could NOT be social engineered or hacked into revealing it.
Some random guy complains that "it's not his fault his account was hacked" & that he "deserved" his account back. He eventually finds a screenshot but calls for Apple to change the system to add a backdoor so that they can recover any account they want.
The attack wasn't random guy's fault but it was his fault to not save his recovery key. More importantly, any social engineering or leakage of everybody else's accounts that occur due to Apple backdooring their 2 factor ID WILL be in part his fault. Way to go there, of course your convenience is more important than our security...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
So, the actual story here is that Apple has access to your encrypted files and can decrypt them at will, its just selling it as a nice convenience for you...
I guess that's the "law enforcement cannot access encrypted iPhones" issue solved.
The authentication of that data tells you that it hasn't been tampered with. If it was encrypted, you'd still have a now authenticated bit of encrypted data.
I forsee this as a problem. As part of policy we have to encrypt mobile devices, and we store the recovery key in case the users get locked out. We cannot have someone calling apple (for which we don't setup account for our devices) to unlock these units. Apple cannot be the arbiter of access.
Because social engineering is like the hardest point of entry of any computer system. A'ight. Mitnick approves
Furthermore, I wouldn't trust those Apple "geniuses." They are utterly clueless and unhelpful. I recently had to call in to get some help because someone else had somehow managed to open a new account using my email address instead of theirs (ours were similar). Apparently there's no email verification before they can use it for an account. Anyways, I kept getting bombed with email intended for him so I reset the password on the account (since I'm in control of the email, this was easy) and noticed he had set his actual email as the recovery email--which I could not remove nor edit in any way, meaning he could then reset the password too. Point is, I either wanted them to remove my email from the account, or remove his recovery email from it, and the "geniuses" I had talked to couldn't seem to understand that simple request. In the end, their best advice was, "I don't know. Just deal with it I guess? There's nothing we can do." So, here we are still, both of us still have access to this account and neither of us can do anything about it.
Great customer support.
that is backwards step and they have caved in to government pressure for data access. As instead of being 'lost' they can just hand the data over.
Exactly, if you can reset your account password by "talking to a human", all the Fed has to do is talk to that same human.
This is just because they probably had too many Apple users call them with "I lost my password, can you reset it? Recovery key? What's that?".
Since there are probably ten times as many of those, compared to the number of people who actually care about security, it makes sense for them to dumb down the system. Keeps the majority of their users happy. And the Fed, to boot.
Aren't humans a problem with a lot of important hacks anymore. For example:
http://appleinsider.com/articl...
If not for a human at Apple, this hack wouldn't have happened. The authentication code was intended to prevent this issue.
Sounds like they might be spinning "The government forced us to change our design so we can break the encryption for them"
TO: "For your convenience, you no longer have to keep a copy of a 14 character recovery code to decrypt your phone: now we can just recover your account for you with a 'super-secure' human verification of the last 4 digits of your credit card that 10 other online retailers know about, and your SSN that can be looked up in a public database."
If you read the available information about this, there seems to be many procedures in place to avoid social engineering. Also, there is nothing here about anyone having access to any ones files or data (encrypted or otherwise). Just procedures which would allow one access to there own account, this would be akin to an automated password reset.
That said, a lot of the details about this are unknown.
--- Nothing To See Here ---
Why would the Federal Reserve be interested in your Apple ID?
Except this is the recovery key for an Apple account, not an encryption key. Apple explicitly has access to information about your account. For example, they know which songs you've purchased from iTunes and which iPhone apps you've downloaded.
This has nothing to do with encryption. This information is already available to the government if they have a warrant. The recovery key in question here is to authenticate, not to decrypt.
So my apple security key is in my gdrive, my gdrive offline codes are in my hotmail account, and my hotmail accounts offline auth thing is in my lastpass cault..
This is why I don't trust any one person/organisation with *all* my details.
- http://www.milkme.co.uk
Your apple ID can unlock your iCloud account, which also hosts an e-mail service. Some people use their apple ID to access their personal e-mail.
"what's my password" is basically what constitutes the pie slice.
You know, the biggest one. In the pie. The pie that is IT support. Anywhere.
This may have come as a request that Apple couldn't refuse - think of this as a canary.
Know we know, and knowing is half the battle.
I'm confused by this. It's very easy to remove a rescue email from your account, you can do it yourself. Here is an article that describes how: https://support.apple.com/en-u... Once you have removed that rescue email only the person with the password to the primary email address will be able to get in to reset the password. If you need to reset your security questions to access the section where that information is located you would have to call in to support and verify that you are the account holder.
Monumentally stupid of them.