Apple to Begin Enforcing Per-App Passwords to Improve iCloud Security

Apple will roll out a change to its two-factor authentication measure which will allow users to easily manage apps that connect to iCloud and revoke permissions in case rogue behaviour is detected. Apple will generate unique passwords for apps that need to access a user's iCloud account for file storage or any other reason.

Users currently authorise apps using their iCloud passwords if they don't support two-factor authentication, and so Apple's new measure will give users an additional level of insulation. Since each authorised app has its own password, blocking its access becomes as simple as revoking the password, which can be done from the iCloud account management page on Apple's website. Apple has used the examples of Microsoft Outlook, Mozilla Thunderbird and BusyCal, which can all be tied in to a user's iCloud account.

The news was reported by 9to5mac, along with a copy of the official email sent out to Apple users reminding them that apps will need to be reauthorised to work with the new scheme. The measure was supposed to have come into effect on October 1, but was delayed.

Apple hopes to encourage users to turn on two-factor authentication, especially in light of a recent scandal in which the company was blamed when malicious attackers managed to gain access to celebrities' private accounts and steal private data including nude photos, which were then published on the Internet. While Apple took great pains to clarify that users' passwords were compromised rather than its own server security, it has since taken steps to improve account security.

iCloud users now receive notifications when their accounts have been accessed via a Web browser, and two-step authentication has been expanded to cover iCloud data, whereas it was previously only used to safeguard users' Apple account information.

iCloud storage pricing was also recently reduced, in an effort to match competitors and increase adoption of cloud storage.