Apple has implemented a new two-step verification system for Apple IDs (via 9to5Mac), adding an additional layer of protection for Apple accounts with an extra security code and a "trusted" device.
Two-step verification will require you to verify your identity using one of your devices before you can make changes to your account or make an iTunes or App Store purchase from a new device. You will also get a Recovery Key for safekeeping which you can use to access your account if you ever forget your password or lose your device.
Once enabled, the new system replaces the standard security questions that are asked before users make purchases on a new device and password resets can only be done from the designated iPhone or iPad.
/article-new/2013/03/twostepverification.jpg?lossy)
As the recovery key is used in place of security questions, keeping it secure is of the utmost importance. A lost or forgotten key can be recovered with a trusted device and a password, just as a password can be recovered with a trusted device and a recovery key.
The verification system will request a password that has one letter, one number, one capital letter, and at least eight characters. If such a password is not already in use, users will need to wait three days to fully enable two-step verification. Users with an already compliant password can move on immediately to the next step.
A security code will be sent through SMS or using the Find My iPhone app, and during setup, users can choose a single trusted device. To begin the process, users can visit the Apple ID website to implement two-step verification.
Top Rated Comments
Perhaps you missed the part that it's optional?
:rolleyes:
John Appleseed? Is that really you?
Apple introduces two-step verification and people complain.
Really sick of the anti-Apple everything happening these days. Sheesh.
That's the kind of code only an idiot would have on his luggage... //www.youtube.com/watch?v=a6iW-8xPw3k :D
It works with other services like Dropbox, Lastpass, Amazon Web Services and Facebook because it is based on some standard method of creating codes. You don't even have to use the official Google Authenticator app, there are several others like Authenticator for Windows Phone and a version for so called Java dumb phones.
Someone asked about Facebook and Google Authenticator. They are telling you to use their own code generator but they are really just using the same method as Google and Dropbox. Just click the help button when you are setting it up and look for a 16 digit code (or something), this you type in Google Authenticator and it will give you one time codes back. I can confirm this is working. Also, nothing stops you from using several devices with Google Authenticator (or third-party alternatives) as long as you set them up at the same time.
You should of course have auto lock enabled on your phone if you are using a phone application like Google Authenticator to create codes. And it is still a good idea, even with 2 step activated, to use a password manager to create passwords for most accounts and Diceware for accounts where you have to remember the password.
Too bad Apple did not choose to support Google Authenticator.