Bypassing a Yubico Security Key

[F-Train]

Thought I'd pass this on in case someone else runs into a similar difficulty.

I use a Yubico Key with both my Mac and an iPhone. This morning, I left town for the weekend. I forgot to bring a Key and needed access to my Apple I.D. to set up a new Mac. No go without a Key. I have an Apple Recovery Code, but didn't see a way to enter it.

My iPhone to the rescue. Went to iPhone Settings > My Name > Password and Security > Security Keys. I chose Remove Security Keys and the two Keys disappeared.

When I entered my Apple I.D. and password on the Mac, it reverted to standard 2-factor authentication. The usual 6-number code was sent to my phone. Entering the code on the Mac gave me access to my Apple I.D. account.

When I get home, I'll set up the Keys again on my phone. Only takes a couple of minutes.

As a practical matter, I don't see this as a security flaw, but rather as a useful failsafe

 

[bobcomer]

As a practical matter, I don't see this as a security flaw, but rather as a useful failsafe

It's both, depending on who does it and if they saw you enter your PIN and then stole your phone. It's probably a failsafe far more times than not, but that doesn't help the people that had the other problem.

 

[F-Train]

... if they saw you enter your PIN and then stole your phone.

Yes, but Apple introduced Face I.D. six years ago, and the thief still needs to get into the computer.

Anyway, I've seen the possibility of using an iPhone to do this discussed a couple of times. Thought I'd pass on confirmation that it works. Basically, if you reduce Apple I.D. security for one of your devices, it reduces security for all of your devices.

As I said above, I have an Apple Recovery Key. This is Apple's page on Recovery Keys: https://support.apple.com/en-us/HT208072 It wasn't offered as an option when I was trying to access my Apple I.D. on the Mac. I was setting up the Mac, and maybe the problem was that my Apple I.D. wasn't yet associated with it.

 

[bobcomer]

Yes, but Apple introduced Face I.D. six years ago.

And it still asks me to key in the PIN when I'm in public occasionally. No clue why.