Security experts applaud Apple's new two-factor authentication
There's no evidence that Apple is using such an approach, Storms acknowledged, but it could. "They own the infrastructure [for Find My iPhone] on the server side, the client side, the application, and so on," he noted.
Apple also took customer service out of the equation, instead providing a 14-character recovery key for password resets or when the iOS device assigned to receive passcodes has been lost or stolen.
That's important. Last summer the hack of Wired reporter Mat Honan Apple ID was commandeered when attackers convinced a company support representative to give them access to his account.
Several other well-known Web services have also recently added optional two-factor authentication to secure their users' accounts, often after their networks were breached.
Dropbox, for example, added two-factor last August after usernames and passwords were stolen from another website, then used to access accounts. Facebook debuted two-factor in 2011. And Evernote, which had to reset 50 million passwords earlier this month after a hack, promised to speed up work on two-factor authentication.
Apple, while not the last major technology company to add two-factor, was certainly not at the forefront. "They seem to be slow to implement all kinds of things that seem so obvious to everyone else," said Storms.
Even so, Storms acknowledged the company's expertise. "Two-factor is two-factor is two-factor. You either implement it correctly or it's not two-factor," said Storms. "What's going to make the difference is how convenient they make it for the end user. And as we know, Apple has a seriously-good history at making good user interfaces. If anyone can make two-factor so friendly that everyone wants to use it, Apple is the one to pull it off."
Apple's move came just in time to give customers a way to protect their accounts from a password-reset hack revealed Friday by The Verge, which had found instructions online that showed how to reset an Apple ID password using only a user's date of birth and the account's associated email address. By day's end, Apple had fixed the vulnerability and restored the iForgot password-reset site.
Apple will roll out two-factor authentication in the U.S., U.K., Australia, Ireland, and New Zealand, then add other countries down the line.
The company has also posted an FAQ with more information about its two-factor authentication.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
- Trade-in volume signals 'tremendous' sales for iPhone 6
- Carmakers put Apple's CarPlay in the slow lane
- Apple updates OS X Yosemite public beta
- Even rivals are waiting for Apple to get into wearables
- Apple preps final non-security Mavericks update
- New Yosemite dev preview may herald public beta update later this week
- iPhone 5C's China bust raises questions about Apple's pricing for '14 models
- Mac sales so far in '14 may signal share push
- China scrubs Apple's iPad and MacBooks from government buying list
- Circle the date: Apple's iPhone 6 event slated for Sept. 9
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts