On Macs, Apple's two-factor authentication still doesn't protect iMessage, iTunes, FaceTime, or the App Store
Context & Ripple Effects
Dani Grant's Medium write-up lands a direct hit on Apple's security story: on Macs, the company's own two-factor system guards iCloud sign-in but leaves iMessage, FaceTime, iTunes, and the App Store reachable with just an Apple ID password — meaning a stolen password still exposes conversations and purchases. The timing matters: within a month, Apple quietly closed part of that hole by enabling two-step authentication for iMessages and FaceTime, and by mid-2015 it was already reworking the mechanism itself, dropping the Recovery Key in the version shipped with El Capitan and iOS 9.
That sequence set the pattern for everything after: what was an opt-in nicety in 2015 became compulsory infrastructure once Apple's own products depended on it.
First-order effects
- Mac users relying on 2FA as a blanket shield are exposed right now on four named services — iMessage, FaceTime, iTunes, and the App Store — where a phished or reused password alone can grant access.
- Apple faces immediate pressure to extend coverage service-by-service rather than at the account level, and its February move to protect iMessages and FaceTime shows how fast that pressure converted into product changes.
Second-order effects
- Developers become the forcing function: Apple's 2019 requirement that Developer Program members enable 2FA turned the optional feature into a gate for anyone shipping through the App Store, propagating the fix far beyond consumers who never opted in.
- Once 2FA is near-universal, it stops being a differentiator and becomes a dependency — Apple's Passkeys launch explicitly requires it, tying new authentication features to the adoption base built by mandates like these.
Third-order effects
- If the pattern holds, platform owners shift from selling security as a user choice to enforcing it as a precondition of participation — with Apple able to claim high enablement rates precisely because its own services and developer gates made opting out impractical.
- It also sharpens the credibility question critics like David Heinemeieir Hansson raised about whether App Store security claims match reality: gaps like this one give skeptics concrete evidence when arguing marketing outpaces actual protection.
The trend: Consumer platforms are moving authentication from an opt-in feature to an enforced prerequisite, driven first by their own services and developer ecosystems needing it.