Apple reenforces iCloud after celebrity debacle
Apple has offered two-factor authentication for a while, although its iCloud storage service has remained curiously unprotected. In the wake of some furor surrounding the service's security, Apple's two-factor authentication now applies to iCloud as well 鈥� if, and only if, you activate it.
聽put the new two-factor authentication through its paces. As recently as last week, anyone with an Apple username and password could access a user's iCloud storage, which backs up documents and photos from iPhones and iPads by default. Apple passwords are not terribly difficult to acquire; software like the Elcomsoft Phone Password Breaker (intended for legitimate password recovery) can usually do the trick.
After activating two-factor authentication on iCloud, the Ars Technica researchers found that they received an unspecified HTTP request error when trying to download backups with Elcomsoft. Two-factor authentication will also protect against those who try to access your iCloud account directly 鈥� if they've come across your password from a data breach, for example.
In case you've never used two-factor authentication, it's a simple idea that can thwart just about any kind of online account compromise. Instead of logging in with a simple username and password, the service in question will also send a unique code to your phone or another e-mail address. Unless a malefactor also has your phone or email login details in his or her possession, your data remains safely yours.
There's only one problem: as two-factor authentication is an optional process, most iCloud users are still unprotected. Not only does this leave their data potentially unprotected, but also opens up another potential catastrophe: If an unauthorized user activates two-factor authentication, that effectively locks the legitimate owner out of his or her account.
If you use iCloud, consider activating two-factor authentication by following the instructions on聽Alternatively, back up your data manually rather than automatically syncing it to iCloud. The process is more cumbersome, but also less prone to intrusion.
