iOS 10.2 and 2 Factor Authentication - Beware

Having just upgraded my iDevices to iOS 10.2, I found that you have to treat the device almost as if it were new - Apple ID, iCloud ID and so on. Probably a very good security requirement, though a tad irritation when you have several devices.

But a new feature is the pressure to start 2 Factor Authentication (2FA). Just a simple warning to folks - as you go through the ID stuff and hit "next" and "continue", it's very easy to miss the 2FA prompt and say "continue". Then you're into 2FA. True, you can go back, it's not irreversible. Could catch you out though.

In fact, you need to choose "other options" instead of "continue" and then choose "do not upgrade security". This gives the somewhat misleading impression that your security is somehow is not up to date or lacking.

I have no real problem with "true" 2FA in principle, but don't at all like the Apple version of 2FA. Lots of threads here about it. This is the first time that I have encountered "pressure" to use 2FA after an upgrade as part of the initiation process.

Ian

That is surprising Ian, I didn't encounter any of that at upgrade because I had already initiated 2FA in iOS 9. A had switched it on because I wanted an App Specific Password for a 3rd party email client to access iCloud mail. Figured I would switch it off again but have found it quite easy to use in iOS 10. When it asks for a numeric password it sends it to my iPhone at the same time as iMessage.
Say I use a VPN on my MBP and I appear to be in Singapore Apple will query that and send me a password to my "trusted" device being my iPhone.


Sent from my iPhone using Mac Forums

I interpret this as one of those nuisances that's better in the long run. I had someone hack my old Facebook account and two factor authentication helped to mitigate it.

Two-factor auth is somewhat confusing though if you're not familiar with it and people I've talked to seem to think it's an unnecessary complication. I think that the difficulty here might be more about explaining its benefit and less about the tech.

So, I'd agree Ian - for many, it'll be an irritant for many people now but the benefits are great.

Oh I agree with you both that 2FA has undoubted merits and my post was not intended to convey otherwise. I did mention that Apple's version has brought difficulties to some, but that does not detract from the principle.

What surprised me was that this was the first time it was offered as an option in the post-update initiation and that it was (a) all to easy to be sucked into this process unwittingly and that (b) the means of bypassing the option was not immediately obvious.

Very nice of you both to take time out to reply.

Ian

IWT said:

Oh I agree with you both that 2FA has undoubted merits and my post was not intended to convey otherwise.

Click to expand...

Oh, I didn't read it that way - I see that you like it.

I was simply trying to say that I'm not sure how one communicates the value of it in a way that is easy for non-techies to get and see as valuable (and not as a nuisance), particularly on a setup screen where there isn't much room for text or a demo of it.

What surprised me was that this was the first time it was offered as an option in the post-update initiation and that it was (a) all to easy to be sucked into this process unwittingly and that (b) the means of bypassing the option was not immediately obvious.

Click to expand...

Actually Ian, it's not the first time Apple has offered it. They started doing it with the implementation of iOS 10. As stated, 2FA has benefits but can cause problems if one forgets where and how that second authentication will occur. For now I have avoided it for our iOS devices primarily because my wife is not tech savvy and we use the same Apple ID for everything.

Yeah, the still too "techy" nature of 2FA is the biggest hurdle right now. Apple has a reasonably nice 2FA implementation with its OSes but it still looks much too complicated for most. If you do go with it though, it's wonderful.

Yup, noticed that too and opted out ... for now at least.

IWT said:

Oh I agree with you both that 2FA has undoubted merits and my post was not intended to convey otherwise. I did mention that Apple's version has brought difficulties to some, but that does not detract from the principle.

What surprised me was that this was the first time it was offered as an option in the post-update initiation and that it was (a) all to easy to be sucked into this process unwittingly and that (b) the means of bypassing the option was not immediately obvious.

Very nice of you both to take time out to reply.

Ian

Click to expand...

Yes, they was my take on it as well, sometimes Apple seem a little over aggressive in thier "suggestions," like how encryption was pushed during upgrade to Mavericks. You really had to go out of your way to refuse it or it was initiated automatically.

Rod Sprague said:

You really had to go out of your way to refuse it or it was initiated automatically.

Click to expand...

It was? I must have absentmindedly click no (or I had a machine encrypted for months without knowing it).

I'm with vansmith on the encryption. I've heard it was an "out of your way" experience to refuse encryption from others, but either it wasn't really that hard or like vansmith, I've been encrypted ever since it came out (but I'm not, I know that for certain).

I still haven't forgiven Apple for getting rid of the swipe to open my 5s in the last update! It irritates me more as time goes on and I'm convinced this was intentional on their part to get people to buy a newer phone!!

badshoehabit said:

I still haven't forgiven Apple for getting rid of the swipe to open my 5s in the last update! It irritates me more as time goes on and I'm convinced this was intentional on their part to get people to buy a newer phone!!

Click to expand...

I thought that you finally got used to using your fingerprint(s)? And of course Apple wants you to buy a new iPhone every year, that's why they implemented their new trade in program and even included Apple Care Plus. Who would have ever thought a phone would cost $800 to $900? My first car was only $600. I must be getting old.

LOL - mine was £22, jumped out of second gear and the hinge was wrecked on the driver's door! My dad taught me to drive in it.

The fingerprint operation is so temperamental.

Mine had no first motion shaft in the transmission, so I had no 1st gear or reverse. Learned to park pointed uphill so I could roll back out of the spot and burned the clutch starting in second gear. Ah, those were the days!

Thanks for reminding me to turn two factor authentication back on. I forget why, but I turned it off, and this thread reminded me about that, so I did turn it back on.

I opted out because I found it impossible to use at Home, where I get no phone signal.

Therefore, once I returned to work (with a mobile signal) I opted out.

Since then, every time I apply an update I have to be careful not to get trapped into the 2FA again. I will not quote here my opinion of the meaning of "FA" in this instance

Since then, every time I apply an update I have to be careful not to get trapped into the 2FA again. I will not quote here my opinion of the meaning of "FA" in this instance

Click to expand...

LOL, yes Apple's 2FA leaves much to be desired.