# IOS "Two-Factor Authentication" and PCs on the web **URL:** \ **Category:** Factual Questions\ **Created:** [April 10, 2017, 1:02pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167 "2017-04-10T13:02:10Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Napier](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Napier](https://boards.straightdope.com/u/Napier)\ **Post date:** [April 10, 2017, 1:02pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/1 "2017-04-10T13:02:10Z")
My phone and Mac are bugging me to turn on Two-Factor Authentication but I haven’t found any description anywhere of how web access via my work PC would get me into iCloud. It’s not my PC and I’m not allowed to install personal software on it. Will I still be able to use the PC to access my calendar, notes, reminders, et cetera? Thanks! ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [April 10, 2017, 2:00pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/2 "2017-04-10T14:00:24Z")
I go to [iCloud.com](http://iCloud.com) and have access to everything there. ---
**Author:** ![Disgscen](https://avatars.discourse-cdn.com/v4/letter/d/f05b48/32.png) [@Disgscen](https://boards.straightdope.com/u/Disgscen)\ **Post date:** [April 10, 2017, 5:00pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/3 "2017-04-10T17:00:20Z")
Accessing [icloud.com](http://icloud.com) will get you into the things you want–currently. If you turn on 2FA, iCloud will sometimes ask you to confirm yourself by typing a 4-digit code into your work PC’s web browser. They’ll give you that code over your phone, which means the phone requires internet access at your work. ---
**Author:** ![DataX](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@DataX](https://boards.straightdope.com/u/DataX)\ **Post date:** [April 10, 2017, 5:01pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/4 "2017-04-10T17:01:25Z")
> [@Napier](#): > > My phone and Mac are bugging me to turn on Two-Factor Authentication but I haven’t found any description anywhere of how web access via my work PC would get me into iCloud. It’s not my PC and I’m not allowed to install personal software on it. Will I still be able to use the PC to access my calendar, notes, reminders, et cetera? > > Thanks! I’m almost certain you would, they seem to have thought it out pretty well I would absolutely turn it on We might have a different president if people had used two factor authentication ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [April 10, 2017, 5:07pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/5 "2017-04-10T17:07:37Z")
> [@Disgscen](#): > > They’ll give you that code over your phone, which means the phone requires internet access at your work. They text it to you via SMS, right? That doesn’t require internet access, just cellular service. ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [April 10, 2017, 5:46pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/6 "2017-04-10T17:46:46Z")
> [@markn\_1](#): > > They text it to you via SMS, right? That doesn’t require internet access, just cellular service. Yep. ---
**Author:** ![Napier](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Napier](https://boards.straightdope.com/u/Napier)\ **Post date:** [April 10, 2017, 10:25pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/7 "2017-04-10T22:25:03Z")
Thanks everybody!! ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [April 11, 2017, 12:03pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/8 "2017-04-11T12:03:09Z")
Of course, the NIST has pointed [out](https://techcrunch.com/2016/07/25/nist-declares-the-age-of-sms-based-2-factor-authentication-over/) that 2FA is really not secure and should be avoided. Which, oddly, has resulted in none of the big companies switching over to an actual secure system. Anyway, don’t think that you’re going to be safe using it. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [April 11, 2017, 12:37pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/9 "2017-04-11T12:37:27Z")
To be fair they have said the 2FA via SMS should be avoided. SMS has variable and often low quality encryption, and this is only on the radio link anyway. The link from the sender to the radio network provides no encryption. So any state actor could be reasonably expected to be able to intercept an SMS based 2FA login key. Interception by other nefarious actors is probably not too hard either. This doesn’t mean 2FA is a bad thing. Indeed if you use Apple’s closed environment and have an iPhone the second key won’t come via SMS anyway. iMessage has end to end encryption. The lack of this with SMS is its downfall. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [April 12, 2017, 12:56pm UTC](https://boards.straightdope.com/t/ios-two-factor-authentication-and-pcs-on-the-web/784167/10 "2017-04-12T12:56:47Z")
As noted by the NIST report, the foremost problem is the SMS being sent to a faked phone number. End-to-end is fine if both ends are _first_ verified as being authentic. And if you have verified that the SMS is being sent to the correct device in the correct hands then you’ve gotten to the level of security you need anyway. I.e., the authentication has been achieved. Sending an SMS at that point is a waste of bits.