jdavis/twofactorauth — pull request #626 by reshleman (2014-07-08 03:45:27+00:00)
Title: Clarify iCloud exceptions/restrictions

I've added some clarification to how Apple applies 2FA to iCloud data. The list currently implies that personal information stored in iCloud is protected by 2FA, but that's not the case. Per http://support.apple.com/kb/ht5570, 2FA only applies when you take one of these actions with an Apple ID:

* Sign in to My Apple ID to manage your account
* Make an iTunes, App Store, or iBooks Store purchase from a new device
* Get Apple ID related support from Apple

In particular, signing in to iCloud.com on an untrusted device, signing into iCloud via Settings on an untrusted iOS device (to synchronize data), and attempting to restore an iCloud backup onto an untrusted device **will not** trigger 2FA verification. (Additional explanation and implications [here](http://arstechnica.com/security/2013/05/icloud-users-take-note-apple-two-step-protection-wont-protect-your-data/).)

I've added some wording to the "Exceptions/Restrictions" section for iCloud to clarify this. I'm open to rephrasing for clarity, if you think it needs it.

(I've also slightly modified the wording for Apple's SMS support, per #623 and #624. This matches the current wording for Twitter.)