Mac + GrapheneOS - How do you handle AppleID?

Pearshaped

Hello all,

I would like to use a Mac Desktop and a Mac Laptop alongside and a GrapheneOS phone.

One thing that seems to be troublesome is Apple's insistence on sending 2FA codes or confirmation dialogues to other Apple devices you are signed into with that AppleID.

This worries me as I currently own only two apple Devices: the Mac desktop and the Mac laptop. When I am traveling, I obviously only have the laptop and would be unable to access any codes sent to the desktop.

@ GrapheOS users who use Macs: how do you handle AppleID?

krysor

Pearshaped MacBook is the only Apple device I own and I have trouble to grasp the issue. I use another password manager and I never use the 'log in with Apple' so I never get the aforementioned 2FA codes unless to my phone number or my email address. Does it ever happen while working on the laptop that you get a 2FA sent to the desktop?

userofgos

Pearshaped The Apple 2FA you are referring to is only required when setting up a new Apple device, or signing into your Apple account from on a new web browser (or any browser if you have cookies disabled)

See here: https://support.apple.com/en-gb/102660?ref=martinlarosa.ar

When you sign in to your Apple Account for the first time on a new device or on the web, you will need both your password and the six-digit verification code that will be automatically displayed on your trusted devices.

I've never encountered this issue for the since switching to A Pixel 8a with GOS. Though I did have an iPhone when I first setup the device 3 years ago.

Pearshaped

I know that you can use a Mac without AppleID but to use features like FindMy as well as the App Store, you have to use an AppleID.

krysor

I'm logged into an Apple/iCloud account on my Mac and I'm using both FindMy as well as the App Store and I don't encounter the problems mentioned.

n3t_admin

I also don't understand the problem: you just use your trusted phone number to send you a 2FA code or you set up a pair of security keys. If this doesn't satisfy your threat model, you might have a problem of course.

Pearshaped

I really appreciate the responses in this thread.

userofgos This is the kind of thing I am afraid of (only being able to set up a new device with access to an existing trusted device, etc).

I wonder if you can just use Yubikeys for this if you have them set up like @n3t_admin suggested.

If I was really able to use a security key as a second factor in all possible contexts, then that would be an amazing solution.