app-specific passwords

Yeah...

So the ability to generate app specific passwords right now, without 2FA is what is ending on June 15. I never did, but I am now guessing you could have generated one for convenience... no need to wait for a verification code to arrive... use the app specific password instead. I could be way wrong.

It will be for any non Apple app that has no native awareness of 2FA. Native Apple apps will behave as now... waiting for the code.

FYI... here is the email... I think the part that is causing concern is the auto logout on the 15th they refer to.

Well, when I revoked my App-specific passwords for Messages & FaceTime, I now can see that it did automatically sign me out of those two apps on everything. Here are the messages I got on my Mac and iPhones respectively:

Mac:

iPhones:

The interesting part is that revoking the App-specific password caused the two apps that used to require one to sign out, but the App-specific password was not required to sign back in. I revoked the new one and the exact same sequence of events occurred. I was not signed out of iCloud - just those two apps, and signing in with my existing Apple ID password worked just fine and got both apps signed back in again with all of the phone numbers and emails in place.

I am particularly interested in the fact that the message "The password for me@me.com needs to be updated" did not mean it needed to be changed - just signed in again. Good to know in future when we get posts where people are unhappy because they are getting prompted to "update" their password, it may not actually mean it needs to be changed.

Fun experiment 🙂

GB

Any non Apple app that has only a single password "box" for authenticating your iCloud credentials.

Apple apps will ask for a password and then wait for, and allow you to enter, your 2FA verification code. 2 boxes for data entry.

An app specific password has both a password and an Apple issued verification code embedded in one single string for entering in these non Apple apps.

Hey LACAllen,

Unless something has changed, app-specific passwords are strings of characters that you generate on your Apple ID acccount, and are then used in place of your Apple ID password. For example, a very old one that I had for Messages, and which has since been revoked was: vojn-hwyw-tgas-juqi. Once it was generated, you had the opportunity to cut and paste it to use for signing in at that point.

But again, things may have changed. I'm not sure you even need an App-specific password for Messages and FaceTime as you previously did for Two-Step Verification.

OK - I just did an interesting experiment. I revoked all of my existing App-specific passwords, and both my Mac and my iPhones popped a message box asking me to sign into iCloud and change my password. I signed in on my iPhone with my existing password, and it worked fine and removed the message. I also checked FaceTime and Messages before I signed into iCloud again, and although Messages was still signed in, FaceTime was not. So, I'm thinking that these had been signed in with the App-specific password, and when I revoked all of them, it signed me out (of FaceTime at least). On my Mac, I had dismissed the iCloud sign in pop-up, and when I checked FaceTime and saw that it was signed out, I signed back into it directly in FaceTime. I tried using a new App-specific password to sign in, but it didn't like it. I then used my regular Apple ID password, and it signed me back in again.

So, it looks like the App-specific password is no longer required for FaceTime and Messages (which is something I was wondering about). I'm using Two-Step, so maybe it was never required for those apps for Two-factor, but now it appears that it is only needed for 3rd party apps that use iCloud data as the email has indicated.

Just thought I would share. I found it interesting 🙂

Cheers,

GB

If you are referring to the changes that come into play in June, then it;s any 3rd party app that has access to your iCloud.

Agreed... all expected behaviour.

Not necessarily understood, but expected. We'll have this now in case of need.

All good to know!