Apple Adds Two-Step Verification to iCloud and Apple ID

> Why do you find this more friendly than Google Authenticator? Just because it pushes rather than requiring the user to open an app?

Exactly. I have so many things in Google Authenticator that I have to scroll. The timer is also annoying -- sometimes you have to wait for a few seconds for the codes to refresh so you have enough time to type in the code.

> Can you still manually get a code, in case you lack network (& don't want to break out the backup code)?

No, but for Apple you don't need to do this because you only need the code if you're accessing their website so you have to have internet access. I don't think I ever use the Google Authenticator without internet access.

> What if you're actually logging in with the iDevice, does it just automatically allow it without asking?

No idea.

So you mean that the strength measurement is send from the client to the server alongside with the hash+salted password? Password are hashed+salted on the client side right? They're not transmitting password "in the clear" to hash+salt them on the server side? (even on SSL I'd be worried about passwords travelling between client/Apple-severs seen the number of hacks trying to exploit SSL/TLS recently)

It's kind of sad that it's taken Apple so long to do this, and they've done such a mediocre job of it. Offline verification vs. SMS, taking advantage of the secure element in 3GS+ phones, etc., and supporting credential management for third party sites, all would have made Apple superior to desktops or Android for enterprise use, or high-end consumers. But they did none of that.

That's true only for the initial password creation. During verification you could send down two salts, the real salt and a session salt. You double-hash the password on the client with both salts, and the server hashes on the server with the session salt. The hash that gets sent over the wire cannot be used for replay attacks.

I don't think it adds much security though. If you don't trust the channel to properly protect the transmitted password, it's not possible to build a trusted relationship with the server. You have to assume ssl works.

What on earth is Apple doing here. The steps I went through so far:

1) I had to switch my password to something more "secure". That means adding a capital letter and a number. I am sick and tired of companies forcing me to use non-memorable passwords that have less entropy than if I had come up with something memorable, personal and long by myself.

2) "You must wait 3 days to enable two-step verification. This waiting period helps ensure that no one other than the owner of this Apple ID can set up two-step verification. A notification email will be sent to all addresses we have on file. Thank you for your patience."

Regardless of the reasoning for having this in place, all it does is make for a more difficult user experience. Currently when I signed into my Apple ID today, Apple didn't have this process in place and assumed that it was me signing in. So by asking me to change my password when I want to enable this feature it should probably be assumed that I am the account holder. If I was in fact an attacker, changing the password on my account, what if I was on holiday for a week? What if that email hit my spam folder? What if I just didn't notice the email because I am one of the many millions of people who fight inbox zero daily?

EDIT: Furthermore, this has now broken my iMessage and Facetime, with Apple not sending a new activation to my device so I can use these services.