Apple introduced an additional layer of security for iPhone, iPad and Mac users in 2013 by rolling out two-step verification for Apple ID accounts. Two-step verification prevents anyone but you from accessing your Apple ID account, even if they know the password, by requiring a four-digit verification code sent via SMS or Find My iPhone on trusted devices. When you enable two-step verification, you must register at least one trusted device capable of receiving SMS text messages.

twostepverification

Once activated, two-step authentication is required when managing your Apple ID through My Apple ID, signing into iCloud, or making iTunes, iBooks or App Store purchases from a new device. Apple has also expanded two-step authentication to iMessage and FaceTime, requiring users to input an authentication code from a verified device on accounts that have two-factor verification enabled to prevent unauthorized entry attempts through both services.

Overview

Steps to Enable Two-Step Verification

Click on "Get Started…" under Security > Two-Step Verification.
Answer your Apple ID security questions if set and click Continue.
Read "Getting Started with Two-Step Verification" and click Continue.
Add a trusted phone number that can receive SMS text messages and click Continue.
A text message with a verification code will be sent to your trusted phone number. Enter the code and click Verify.

Verify your trusted iPhone, iPad or iPod touch devices with Find My iPhone enabled and click Continue. Or click Skip This Step.
Print or write down your Recovery Key to access your Apple ID account if you ever forget your password or lose your trusted devices.
Confirm your Recovery Key and click Confirm.
Click on the checkbox if you agree to Apple's terms and conditions and click on Enable Two-Step Verification.

Final Words

To ensure continued access to your Apple ID account after enabling two-step verification, it is essential that you record your recovery key in a safe place. Losing your two-factor recovery key could permanently lock you out of your Apple ID account, especially in the event you are being hacked. Without the recovery key, you will be forced to create a new Apple ID.

Two-step verification may provide an additional layer of security, but it is still highly recommended that you set a secure password for your Apple ID account. Avoid using common names, phrases or dictionary words in your password, and try to use as many lowercase and uppercase letters, numbers and symbols as possible.

Tags: iTunes, Apple ID

Top Rated Comments

(View all)

thefourthpope

59 months ago

This security isn't worth the hassle for me. I'm constantly prompted to sign in to facetime and iMessages on my home mini, mb air, and work iMac. Then I get notifications on each plus iPhone and iPads that I signed in on one of those computers. And continuing the minor annoyance factor, iMessages still doesn't reliably sync read/deleted messages, so I get to delete Google or Evernote two-step verification texts four or five times.
This is just adding a new layer of notifications that I tend to think I don't want.

Please note: I have twice specified that this is my experience and my opinion. YMMV.

Rating: 9 Votes

street.cory

59 months ago

This is dumb.

Wasn't the iPhone's fingerprint scanner supposed to do away with passwords?

No.

Rating: 4 Votes

macintologist

59 months ago

Protip, if you want to set this up for your elderly parents, add your personal cell phone as an additional second factor method, that way you can provide tech support much easier.

Also, have your significant other's cell phone be a 2nd factor for your account, and your cell be a 2nd factor for your SO's account. You can have multiple cell phone numbers as 2nd factors.

Rating: 4 Votes

fardeenah

59 months ago

2 factor auth is not available in my country.

Rating: 3 Votes

taxiapple

59 months ago

Thought I would do it.....but before I could enable it, it wanted me to change my password.
My password is pretty good already and Apple has already made me change it at least once before.
I'm not interested.

Rating: 2 Votes

iMerik

59 months ago

Basically, if you and your SO both have Apple IDs, add each others cell phone numbers to the list of 2nd factor devices.

Pretty straightforward what you are saying. I currently have two-step verification enabled with my phone as both my iOS verified device and my SMS verified device. It makes sense to add someone you trust, like a spouse, to the SMS verified device list in case your phone goes missing. It acts as sort of a backup to not needing to use the Recovery Key.

Speaking of the Recovery Key, take Apple seriously when they say you should keep it available but safe. Copy it into 1Password, LastPass, or similar software/service if you don't feel like keeping it on a piece of paper.

Rating: 2 Votes

macintologist

59 months ago

What?

Basically, if you and your SO both have Apple IDs, add each others cell phone numbers to the list of 2nd factor devices.

Rating: 1 Votes

mw360

59 months ago

By making the option available, Apple is putting the security responsibility on the user, where it belongs. If you choose to not use it or use weak passwords, you can only blame yourself.

Sounds a lot like a touch of elitism you have there.

What you're advocating is that a user's security be proportional to their understanding of dictionary attacks, rainbow tables, password entropy and other nerdy esoterica. Why would you want that, and more to the point, why would Apple, of all companies want that? Apple has people who know this stuff inside out. Why shouldn't the users benefit from that knowledge directly, instead of having to learn it all in parallel from blogs and forums?

----------

I completely agree. The spurious password popups on iOS that give absolutely no reason why you should be entering your password again, are ripe for exploitation. It's training users to give away their passwords to any popup that asks for it.

Rating: 1 Votes

viorelgn

59 months ago

I have already set this up. The added security is great.

Rating: 1 Votes

ArtOfWarfare

59 months ago

So what about 4s, 5 and 5c owners?

What about the people who own Android phones? Or no phones at all?

Obviously they continue using passwords like the cavemen they are. For the rest of us (of which I imagine you are probably one), Apple should have done away entirely with the need for passwords by now.

Rating: 1 Votes

[ Read All Comments ]