Slashdot Mirror
Apple Drops Recovery Key From Two-Factor Authentication In New OS Versions
eggboard writes: If you've ever turned on what's now called "two-step verification" for an Apple ID, you had to create a Recovery Key. Lose this 14-digit code and have your password reset (because of hacking attempts against you), and you might lose access forever to purchases and data, as Owen Williams almost did. Apple confirmed today that starting with its public betas of OS X 10.11 and iOS 9, two-factor authentication won't have a Recovery Key. Instead, if you have to reset a password or lose access to devices, you'll have to go through an account verification process with human beings.
If I encrypt something and lose my key, I should lose my data. But this policy is about authentication (i.e. proving your identity) and not encryption. They're different things, except for some reason they are almost always conflated.
Some random guy in the internet has a hack attempt on his account get blocked by his use of 2 factor ID. Instead of being grateful the guy complains on twitter that he is too busy to have correctly backed the recovery key he was warned he was would have to safeguard.
Clearly, Apple's procedures up to now avoided having the backdoor of saving the recovery key. That was OUR responsibility. Not saving it meant that Apple could NOT be social engineered or hacked into revealing it.
Some random guy complains that "it's not his fault his account was hacked" & that he "deserved" his account back. He eventually finds a screenshot but calls for Apple to change the system to add a backdoor so that they can recover any account they want.
The attack wasn't random guy's fault but it was his fault to not save his recovery key. More importantly, any social engineering or leakage of everybody else's accounts that occur due to Apple backdooring their 2 factor ID WILL be in part his fault. Way to go there, of course your convenience is more important than our security...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
So, the actual story here is that Apple has access to your encrypted files and can decrypt them at will, its just selling it as a nice convenience for you...
I guess that's the "law enforcement cannot access encrypted iPhones" issue solved.
Exactly, if you can reset your account password by "talking to a human", all the Fed has to do is talk to that same human.
This is just because they probably had too many Apple users call them with "I lost my password, can you reset it? Recovery key? What's that?".
Since there are probably ten times as many of those, compared to the number of people who actually care about security, it makes sense for them to dumb down the system. Keeps the majority of their users happy. And the Fed, to boot.
Sounds like they might be spinning "The government forced us to change our design so we can break the encryption for them"
TO: "For your convenience, you no longer have to keep a copy of a 14 character recovery code to decrypt your phone: now we can just recover your account for you with a 'super-secure' human verification of the last 4 digits of your credit card that 10 other online retailers know about, and your SSN that can be looked up in a public database."