Mac Security · High-Risk Users & Lockdown Mode · Lesson 4 of 5

Security Keys and Your Apple Account

Physical keys that stop phishing, and why Apple asks for two.

What a security key does

You already use two-step sign-in. When you sign in to your Apple Account on a new device, Apple shows a six-digit verification code on a device you trust. That is good protection. But a clever attacker can still trick you into handing over that code.

A security key is a small physical device that proves it's really you. It looks like a tiny USB stick or a key fob. You plug it in or tap it to your phone.

Apple accepts keys that are FIDO Certified. The FIDO Alliance is an industry group that sets the rules for these keys. The same group's standards are behind the passkeys you met earlier.

With Security Keys for Apple Account turned on, signing in on a new device or on the web needs two things: your password, and either your security key or another trusted Apple device. The six-digit code is no longer used.

Why is that safer? Think about phishing, a fake website or message that tricks you into giving away your details. And social engineering, where someone lies, often on the phone, to get you to help them.

• A fake site can trick you into typing a password and a six-digit code.
• A fake caller can ask you to read the code out loud.
• A security key can't be read out or typed in. It also only works with the real site it was set up for. So a fake site gets nothing useful.

That's why security keys suit people who may be targeted on purpose, such as journalists and activists. Anyone who wants the strongest sign-in protection can use them too.

Two keys and setting them up

Apple asks for at least two security keys, and you can add up to six. The second key is your spare. If one is lost, broken or left at work, the other still gets you in.

Keep one on your keyring and one somewhere safe at home. Don't keep both in the same bag.

Pick keys that fit your devices:

• USB-C works with most Macs and with iPhone 15 or later.
• USB-A works with older Macs, or newer ones with an adapter.
• NFC keys connect to an iPhone with a tap. NFC is short-range wireless, the same idea as tapping a card to pay.
• Lightning works with iPhone 14 and most earlier iPhones.

Many keys have two kinds of connection, which makes them easier to use everywhere.

To add keys on a Mac, open the Apple menu and choose System Settings. Click your name, then Sign-In & Security. Click Two-Factor Authentication, and next to Security Keys, click Set Up. Follow the steps for each key.

Know the limits before you start:

• Devices too old to update can't sign in to your account.
• Child accounts and Managed Apple Accounts, the ones set up by a school or employer, can't use security keys.
• An Apple Watch set up through a family member's iPhone isn't supported.

The biggest warning: you are responsible for your keys. If you lose all your trusted devices and all your keys, Apple says you could be locked out of your account permanently. A spare key, stored apart, prevents that.