So Apple put out a statement today about the whole celebrity photo mess, and I want to talk about the statement itself for a second, not the photos, because I think the actual news part of this got buried under a week of people either being furious or being gross about it.
The line that got me was this: after "more than 40 hours of investigation," Apple says the accounts weren't broken into through some big iCloud vulnerability. It was targeted — usernames, passwords, and security questions, guessed or phished or brute-forced one account at a time. Not a backdoor. Not a hole in the system that affects the rest of us. Just really good old-fashioned account-by-account attacking, aimed at people whose personal info (birthdays, pet names, mothers' maiden names, all that security-question stuff) is basically public record if youre famous enough to have a Wikipedia page.
Which, fine, that's reassuring in the "iCloud itself isnt broken" sense. But it's also kind of the whole problem, isnt it? The security questions thing has bugged me for years and I never did anything about it because it never felt urgent. Today it felt urgent.
I spent about forty minutes this afternoon (during my lunch break, sitting in the car in the parking lot because the wifi at work is somehow worse than my phone's LTE) turning on two-step verification for my Apple ID. It is not obvious how to do this. You'd think theyd put it front and center given, you know, current events, but no — you have to go into My Apple ID, log in, go to Password and Security, answer your existing security questions (the ones youre trying to route around, which is a little funny), and then it walks you through registering a "trusted device" and gives you this 14-character recovery key that you are told, in bold, to print out and never lose. I wrote mine on an index card and put it in the same drawer as my passport, which feels like the correct level of paranoia for a piece of paper that can apparently unlock my entire digital life.
Two-step for Apple ID is clunky compared to what Google's had for a couple years now. With Gmail you get the app codes, the backup codes, the whole ecosystem feels built for it. Apple's version still feels bolted on. You need it enabled before something happens to you, because if you lose your trusted device and your recovery key at the same time, Apple straight up tells you they may not be able to recover your account at all. No backdoor for you, no backdoor for Apple, I guess, though that trade-off is a lot easier to accept in the abstract than when youre staring at your own recovery key wondering if the dog ate the index card.
I also went and changed my security question answers to actual nonsense. My mother's maiden name is now something that is not my mother's maiden name. My first pet was not, in fact, a wolverine. Feels dumb typing that out but it's a real thing you can do in like ninety seconds and it makes those questions basically useless to anyone who could just look you up.
One more small thing: I texted my mom and told her to turn hers on too, and she asked me what two-step verification even was, so I ended up writing her a four-step instruction email with screenshots, which took longer than setting up my own. If youve got a parent with an iPhone and photos they'd rather not have floating around, that's probably twenty minutes better spent than reading yet another hot take about all this.
Anyway. Go turn it on. It's annoying for about a day and then you dont think about it again until your phone dies at the airport and you're locked out of everything, at which point you'll be glad you wrote the recovery key down somewhere that isnt "in my head."