Yubikey + other 2FA methods support

[parawanderer]

Hi @malmeloo , forwarding this request from @milenovic in parawanderer/OpenTagViewer#18

At my work a large percentage of people also use Yubikeys and more advanced auth setups for their Macbooks. So it would be nice if auth via these could be supported.

These are probably not just another variant of the 6-digit code entry as the Yubikey auth code is a rather large (~32-48 chars maybe?) base64 looking string. I also use one for my work laptop (recently switched to a mac due to switching teams, lol) but I can't tell how it's integrated into the apple ecosystem (if at all) in my case. I think the setup is more corporate network than apple ecosystem for me.

[malmeloo]

Wait so how does this work exactly? Do you need to enter that string manually to sign in or is it just a passkey implementation?

Either way the other 2FA options should still work, right? If so this will probably go somewhere to the bottom of my priority list, as you'd only have to do it once anyway if the session is managed properly. It's a good suggestion though!

[milenovic]

Once yubikey 2FA is enabled on the account, all other 2FA options are not available for use in any way. They require two keys to be assigned in case one is lost, but no other factors.
More details here: https://support.apple.com/en-us/102637

[malmeloo]

Ugh, that's annoying. I'll look into how it works exactly, can't promise I'll have much time in the foreseeable future though. I'm not very familiar with how these keys work exactly, so it might take a little while.

[alfs]

Ugh, that's annoying. I'll look into how it works exactly, can't promise I'll have much time in the foreseeable future though. I'm not very familiar with how these keys work exactly, so it might take a little while.

It's based on Webauthn on the networking side and CTAP on the client side to communicate with the token (e.g. yubikey or other FIDO2 device).
Passkeys use the same technology under the hood but store the credentials differently.

As milenovic said, activating yubikeys disables other 2FA methods, so FindMy.py can't be used by those accounts. There are also other aspects. If sim-cards are lost or pre-paid expired when not topped-up, it's very hard to gain access to the apple account since it relies on trusted device and SMS for 2FA. Having 2 (or more) yubikeys enables continued access.

In the case of several burner accounts on a single phone, it also makes logins easier than swapping sims, logging into icloud, and from there authorize findmy access. Just authorize with the key. So it would be nice with support in FindMy.py

As for implementation, I assume much of the support is available as libraries, and the challenge is the 2FA exchange that now asks for trusted device or sms.

A starting point would be to see how Apple requests 2FA when logging into a yubikey locked account.

[Olafejs]

Hi everyone — we’ve submitted an experimental implementation of Apple Account hardware-security-key authentication:

#267

The original adapter successfully completed login on Linux with a Yubico USB Security Key, without removing security keys or weakening account security. The resulting session was also successfully reused.

The PR includes an opt-in FIDO2/WebAuthn login example and 104 new tests. All GitHub checks passed, including tests on Python 3.10–3.14. It is now awaiting review and has not been merged yet.

This is still experimental, verified with one real account/key setup—not a claim of compatibility with every security key.