Be careful when using Apple Security Keys (2FA) as there is no way to recover your account if you lose your keys.

Question

Level 1

4 points

Be careful when using Apple Security Keys (2FA) as there is no way to recover your account if you lose your keys.

A word of warning to anyone considering using hardware/security keys to protect their Apple account, but please don't get me wrong - I'm a big fan of 2FA, passkeys, and hardware/security keys, just be aware of the limitations and do it right.

As of today (Nov 2024), there is no recovery option if you added Security Keys and are not logged into any device - or at least I didn't manage to find one despite opening several support cases.

Unfortunately, I learned that hard way.

Context:

I have 2 Apple IDs primary and secondary - both added to the same 'family' and both configured with the same custom domain,
I lost all my security keys in Jun this year,
I'm not logged in with the secondary account on any device.

What I still have/know:

I know the password,
I know the passcode,
I have access to trusted phone number (it's the same on both accounts),
I have recovery contact (both ways between my primary and secondary account and some other people as well),
I have legacy contact (both ways between my primary and secondary account),
I still have access to that secondary account email,
I still have all the devices I was using in the past with that secondary account (so, serial numbers can be verified and confirmed),
I'm the owner/creator of the 'family' where both accounts are joined,
I'm the legal owner of the custom domain connected to iCloud/all accounts.

So, I have most of the puzzles, just missing a Security Key and still I'm screwed.

I made several calls and opened several support cases (it took me 5 months), and the answer was always the same - there was no way to recover access to my account even though I had everything else.

This is super surprising and confusing for several reasons:

This is just a 2FA, not the main/only login method!!
No proper warning when adding a Security Key neither via MacBook nor iPhone,
No proper warning on the webpage - Apple's webpage just says that 'you might lose' access, but not necessarily that 'you will lose access for sure with no recovery possible',
When combined with other articles like 'account recovery' and 'recovery contacts' I got the impression that recovery is still possible - but that's not true,
Adding Recovery Contacts is still possible even after setting up Security Key - there is no single hint, that will be completely useless in the feature!
Other companies have procedures to recover if you lose your 2FA but still have other puzzles.

Ok, I lost access to my account, but that's not the worst part! As a bonus, I lost access to my custom domain addresses assigned to that account!

Apparently custom domain address is locked to the account, and the only way to re-assign that address is if both parties (old user and new user) confirm the transfer via a push notification sent to the logged device...

Because I'm not logged in with my second account on any device, I cannot confirm that notification - and there is no other way to approve that transfer.

And again there is no way to recover that address - even if that's my domain and I'm legal owner of that domain.

I see no reason why the 'old user' has to agree to transfer the address which I own - it's my property I should be able to transfer it as I wish.

I can easily confirm my ownership of that domain, so there should be some other method to transfer address, something like admin/owner override - all other companies allows that, that industry standard!

Also as an admin/owner I can easily switch my domain to another email provider, so Apple is not really protecting here anything.

I get (kind of) that account is extra protected, but custom (not apple now) domain - why? I'm the owner, so what they care?

Posted on Nov 13, 2024 10:25 AM

Reply

Answer 1

Top-ranking reply

Limnos

Level 10

418,861 points

Nov 13, 2024 11:58 AM in response to LukeMk

Security Keys are for "pro" users so I guess Apple skips a lot of the newbie hand-holding.

About Security Keys for Apple Account - Apple Support

- Because you use a physical key instead of the six-digit code, security keys strengthen the two-factor authentication process and help prevent your second authentication factor from being intercepted or requested by an attacker.

"You're responsible for maintaining access to your security keys. If you lose all of your trusted devices and security keys, you could be locked out of your account permanently."

"No proper warning on the webpage - Apple's webpage just says that 'you might lose' access, but not necessarily that 'you will lose access for sure with no recovery possible'"

Apple loves using conditional terms such as "could" or "would" when what usually applies is "will". It's less scary.

Nobody here works for Apple so we can't explain their reasoning. I would note, however, that if your custom domain is being housed by Apple then they are kind of responsible for helping maintain its security. That includes only allowing those who pass the security level set on the account, which you can no longer do so they have to assume you are a hacker. Freeing up that domain for another user would potentially mean secure information for others going to that domain being revealed.

Reply

Answer 2

Nov 13, 2024 2:41 PM in response to LukeMk

Enabling Security Keys or enabling a Recovery Key will lock out password changes by Apple.

I’m not sure what you would prefer to happen here too, as any bypass defeats the purpose of those keys.

The whole reason for those keys is to prevent that password reset by Apple.

Yeah, the “could be” there is not the best wording. Log some feedback. To log that feedback for that article, view the article, scroll down to the “Helpful?”, tap no, and fill in your feedback. I’ve had some fairly speedy turn-around with that path into the technical writers.

If one or more security keys are lost, add some more keys, or disable security keys before all are lost; before all is lost.

Reply

Answer 3

Nov 18, 2024 9:59 AM in response to LukeMk

LukeMk wrote:

I just realized that Recovery Key at the end is somehow similar to Security Key - it's something 'you have' and if it's printed then it's physical as hardware key and cannot be stolen by malware, so this could be a good recovery for 2FA keys.

Recovery Key is a means to reset a forgotten password, and — because it prevents Apple from resetting the password — reduces exposure to socially-engineered password changes.

Security Keys are a second factor for password authentication. These can permit access when the password is known, and can deny access by others with the password whether from re-use or phishing or otherwise.

Security Keys can be used with a trusted device to reset the Apple Account password. Lose the Security Keys, lose the ability to perform anything requiring a second factor, including adding a trusted device.

Recovery Key is a master key for the Apple Account password, and that doesn’t need a second factor to reset a forgotten Apple Account password. Lose the Recovery Key, forget the account password, lose the Apple Account.

If you don’t have both a trusted device and the Apple Account password, you’ll either need Account Recovery, or a Recovery Key.

Losing all of the second-factor Security Keys and having no Recovery Key is somewhere between Very Bad, and an attempt to socially-engineer access into an Apple Account.

Implementing a means to bypass Security Keys and Recovery Keys defeats the fundamental purpose of those keys, too.

Apple Platform Security doesn't have a good description of how these pieces fit together either, nor much coverage of the additional and semi-related topics of passkeys, and of the built-in second-factor authenticator and its automatic verification codes.

Closest to an overview: Use the Passwords app to create, manage, and share passwords and passkeys across Apple devices - Apple Support

Reply

Answer 4

Nov 19, 2024 7:52 AM in response to LukeMk

The shorter word of warning is akin to this: if you enable Security Keys, don’t lose all of the enabled keys, and do backfill each lost or failed key with a new key, or disable all keys and revert.

Bypassing lost security keys is a bypass.

Use of Recovery Key requires access to the trusted number.

If that’s not working as documented, and if you have access to a trusted number, the discuss it with Apple Support. They may well tell you security keys entirely override recovery keys — that this is a doc error or omission — or maybe they tell you that this is a bug in how recovery keys are implemented.

But I’d assume you’ve proven that losing all the enabled Security Keys is, well, bad.

I’ve logged some feedback on the associated doc.

Reply

Answer 5

Limnos

Level 10

418,861 points

Nov 14, 2024 1:50 AM in response to LukeMk

MrHoffman has apparently had more success than I with the feedback tool on pages. I haven't proposed any change to that particular page but I have found other phrasing issues I have reported with no results and I suspect it is regarded as a stylistic thing, not a technical error.

The only escalation path is to contact Apple again and ask for it to be escalated.

Reply

Answer 6

LukeMk Author

Level 1

4 points

Nov 13, 2024 2:12 PM in response to Limnos

Thanks for the replay, and I agree with you, it's for 'Pros', but - as usual - they implement it slightly different then other companies, so it's not immediately obvious and should be better documented.

"Apple loves using conditional terms such as 'could' or 'would' when what usually applies is "will". It's less scary." - I know this now... I wish I knew it before ;)

My post is not anti-security keys - I'm still a big fan of them, I just wish they will improve docs and UI interface.

Btw. this is how interface looks like - there is no single hint that security key is an ultimate factor and adding it will disable all recovery options:

Reply

Answer 7

LukeMk Author

Level 1

4 points

Nov 13, 2024 2:31 PM in response to Limnos

Other thing is that with custom domain... not sure what do you mean by 'haused', but it's hosted on my servers, and is only connected to my iCloud 'family' by me via DNS.

I have a full control over that domain, so I can disconnect it at any time and switchover to another email provider - there is nothing Apple can do about that, so technically they are not protecting anything and they don't have to.

The problem is that they lock custom address to the account, and admin cannot override that (only Apple do that, every other company allows admins to manage domains as they wish).

Consider in may case I have my customs 'family office' address (office@mycustomdomain), let's say my son is taking car about all our 'family office' things, but at som point I want pass that responsibility on my daughter...

Why my son has to accept the address transfer - it's not his, it's mine... As an admin I should be able to do it arbitraly.

This is well know concept in any organisation - for example you have a 'support@companycomain' address supported by your employee, and at some point that employ left you without notice... so, you are promoting another employee and IT is reassigning that support email to the new employee - there is no reason why that firs employ should accept that transfer.

I understand and accept that I lost access to my account - but issue with custom domain is ridiculous - my only choices are accept the loss (and spend days updating email adres with all companies) or switch to another email provider...

[Edited by Moderator]

Reply

Answer 8

LukeMk Author

Level 1

4 points

Nov 13, 2024 3:00 PM in response to MrHoffman

Thanks for the replay and your advice about feedback - I did that two times, several months ago, and nothing has been improved.

I would really prefer that doc and UI would say explicitly that enabling security key will disable all recovery options, and following that recovery options should be disabled on the UI.

Also I hope that - as the owner and admin of custom domain - I could transfer address to another family account without extra approvals... It's not the account, and it's not Apple's domain, no data, no encryption, so they have nothing to protect here.

Using any other email provider you can manage your own domain as you wish, they are not blocking anything, so I'm not getting why Apple is doing that - perhaps some technical reasons, but in that case even if that option is not available on the public UI, there must be some support procedure to do that, some escalation path or something?

Reply

Answer 9

LukeMk Author

Level 1

4 points

Nov 18, 2024 8:26 AM in response to LukeMk

I just realized that Recovery Key at the end is somehow similar to Security Key - it's something 'you have' and if it's printed then it's physical as hardware key and cannot be stolen by malware, so this could be a good recovery for 2FA keys.

Reply

Answer 10

LukeMk Author

Level 1

4 points

Nov 19, 2024 5:03 AM in response to MrHoffman

Recovery Key is a master key for the Apple Account password, and that doesn’t need a second factor to reset a forgotten Apple Account password.

Could you please advise me where I can find that information?

I'm asking because of I heard this several times, but this is not true... I tested it a few days ago and once you setup security keys, they are required to reset a password, or at least iForgor requires them and no other option is available.

In my tests I had no way to use my recovery key, and that's my proof my point - Apple's documentation ****, it's confusing, unclear and sometimes even Apple's support specialists are getting it wrong.

Implementing a means to bypass Security Keys and Recovery Keys defeats the fundamental purpose of those keys, too.

Let's be clear, to avoid misunderstanding - I'm not suggeting bypassing 2FA, I'm suggesting to have another kind of 2FA or a recovery option - this can be as secure as hardware key.

Let's remove text and email from the equation, as less secure methods then hardware keys... still have some other secure options.

In some sense we could say that a second hardware key is a bypass for the first key? - of course is not that easy, second key is just another key to do a proper 2FA... but since you can have 2+ keys, what's the problem with having 2+ methods, for example hardware key + recovery key?

Recovery key can be as secure as hardware key, of course it has to be different from recovery key for password reset...

We have 2FA to get access, we can and should have 2FA to recover... this can be even 5FA if you like, but still there always should be a way for owner to prove his identity and recover access to your account?

If you loos all of your keys to your home, you can still prove your identity and get help breaking in, your digital account is not different ;)

[Edited by Moderator]

Reply