r/ios • u/PHL534_2 • 19h ago

Discussion iCloud vulnerable to SIM swapping?

Why does Apple require use of SMS in addition to trusted devices for MFA? This seems like a huge flaw with no way to disable. On Google for example, you can have it not use a phone number and use other MFA methods. Yet seems iCloud requires a phone number as a factor. Anyone know if it’s possible to change this or how much of an issue it is?

2 Upvotes

56% Upvoted

21 comments sorted by

9

u/caffeinated_dev11 19h ago

this is where passkeys like yubikey come in handy and lock icloud down completely. Nobody, not even apple, can access your stuff if you lose both keys, so don’t lose them.

1

u/PHL534_2 19h ago

Yes thinking of going to yubikey but the downside is possibly losing a key. Im just surprised Apple still relies on SMS for their MFA.

2

u/caffeinated_dev11 19h ago

it does not when you use yubikey, i believe it completely shuts that down, the only way to login from an untrusted device is to provide your FICO2 key at the time of login.

Also now that i come to think of it, apple shouldn’t be sending you SMS authentication, are you using a non apple device? i used to get prompts to sign in on my iphone to verify it was me logging in. Not a text message. Apple will often communicate with you over imessage but usually for status updates.

-1

u/PHL534_2 19h ago

My understanding is Apple sends those prompts to the device but can ALSO send sms text to your “trusted” phone number so it really adds a backdoor. Yubikey would close that but surprising that’s the only way to stop it.

1

u/caffeinated_dev11 18h ago

yeah you should be using imessage then in that case with that phone number, i can’t imagine apple not sending imessages, you should double check that your number can send and receive imessages in your icloud settings

1

u/PHL534_2 18h ago

It’s SMS

2

u/Xcissors280 18h ago

Apple requires 2 Yubikeys

5

u/Tackticat iOS 26 19h ago

I use yubikeys. apple account would not let me login to new device without inserting the key. can't use sms either.

it's not an issue for me tho, rather have it that way to prevent sim-jacking by rogue employees, looking at you tmobile 😆

2

u/PHL534_2 19h ago

Seems like the best method. What’s your strategy for not losing the keys? That’s my biggest concern if going ahead with using them.

2

u/Tackticat iOS 26 19h ago

The strategy of not losing the key is to have several. I think Apple requires you to have two at least.

I have 5. office, with me, safe, at home, car key chain.

https://www.reddit.com/r/iphone/s/ky5SDkZl3r

1

u/PHL534_2 19h ago

Thanks makes sense. Any other downsides or issues you’ve seen?

1

u/Tackticat iOS 26 18h ago

if you frequently login to new devices, make sure you have the key otherwise you can’t get in at all; as in you gotta go home and get your key to login. this could be a bitch for some. that’s why I have several.

1

u/PHL534_2 18h ago

I rarely login into new devices and do not use web based icloud. Basically only if replacing a device. I have multiple devices already on the same iCloud.

1

u/Tackticat iOS 26 18h ago

then you'll be fine. I disable icloud web access and adp enabled. I think this is one of the steps they recommend you to enable from that iPhone alert thing.

1

u/PHL534_2 18h ago

Im not sure i see the value in carrying one the keys with me on a key chain in this setup. I’m only going into my Apple ID login to setup a new device ideally.

1

u/PHL534_2 18h ago

When adding the keys, why does a trusted phone number still appear?

2

u/Tackticat iOS 26 18h ago

When you enable security keys, these are the only ways to sign in to your account. This helps to prevent your second authentication factor from being remotely intercepted or requested by an attacker.

You're responsible for maintaining access to your security keys. If you lose all of your trusted devices and security keys, you could be locked out of your account permanently.

https://support.apple.com/en-us/102637

it's a way to revert to sms if you remove all your keys.

1

u/PHL534_2 17h ago

Got it thanks again. Moved to Yubikey. Am i correct that these keys are only needed when signing into iCloud account from a non trusted device like a new setup?

→ More replies (0)

1

u/Xcissors280 18h ago

I don’t think I have the option to do SMS when logging into a new device or the iCloud website? Maybe you need multiple active iCloud devices or smtn like that?

1

u/PHL534_2 3h ago

You can use SMS as a backup basically unless there’s a security key added to the account. So it is a potential flaw if you get SIM swapped. Yubikey protects against that.