1

I have had a pretty long-term relationship with a client. We develop medical applications and part of our arrangement is that they lent me a dedicated computer to use for all the work I do with them.

This has worked out well, but recently I upgraded the operating system and it's now bugging me about using Multi-Factor Authentication.

From a security standpoint it seems like a good idea, but I'm not sure I want to put my personal phone number into this machine to use when authenticating. It's a Mac and the apple ID on the machine has been set up as "dev@myclientscompany.com" and nothing on it is in my name.

Has anyone dealt with a situation like this? What's the best way to handle this?

  • 2
    If the company owns the computer, why did you upgrade the OS without them asking you to do so? If they did provide guidance to perform the upgrade, ask the company what to do about the MFA request. – alroc Nov 9 at 21:46
  • @alroc This is a pretty high level relationship. They expect me to maintain the computer. – Sam Washburn Nov 10 at 16:55
  • They expect you to maintain it, yet they own it? Are they paying you to maintain their equipment? If something breaks, who's responsible for the repair? – alroc Nov 10 at 19:16
4

Here are the instructions from Apple. The additional highlight in bold is mine.

Trusted phone numbers

A trusted phone number is a number that can be used to receive verification codes by text message or automated phone call. You must verify at least one trusted phone number to enroll in two-factor authentication.

You should also consider verifying an additional phone number you can access, such as a home phone, or a number used by a family member or close friend. You can use this number if you temporarily can't access your primary number or your own devices.

source

Personally,I would call up the client, tell him that I'm setting up two different phone numbers for two-factor authentication, and to let him make the decision himself about which numbers to use.

My guess is that he'll want you to use your personal cell phone number, plus one of his own business phone numbers as a backup (in case anything happens to you).

Unfortunately, the two-factor authentication method Apple uses on a Mac is not the same as Google's two-factor authentication, so that really limits the options available to you and your client.

2

The easiest and most practical way is to enter the phone number of your private phone. The alternative is to convince the client to pay for a cheap phone and a phone plan for you. The other alternative is that you buy a cheap phone and a phone plan for it yourself. And I think another alternative is that you forever log in with your three answers to "security questions".

You should be the only one who has the password to your apple id, so nobody will be able to log in and get the phone number from your account information.

2

If you don't want to use your personal phone number, use a Google Voice Number. Before you do, be sure to read up on any security issues in doing this, as some people have reported issues with having 2FA send to VOIP numbers.

When you need to move on, you can reassign that Google Voice number to any number supplied by your client.

1

From a security perspective MFA authentication is simply trying to authenticate you based on your credentials.

In a multifactor manner this is done with a combination of methods such as;

  • You have personal knowledge of something; i.e. a private password or answer to security questions
  • You can access some physical device, e.g. your phone which presumably you have on you all the time
  • You can provide identifying characteristics to a scanner e.g. a fingerprint scanner or retina scanner.

All the above methods use 'your own' data/information in some way so using your private phone to my mind is no worse than using knowledge of your password or fingerprint scan.

Of course if you don't trust the system to keep your phone number private well that might be an issue. But if there are other, easier ways to acquire your phone number, then its privacy has already been breached, so the consideration is made moot.

New contributor
Attack68 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.