0

First off, this may not be the right community. If it's not, I apologize and please close this and point me in the right direction.

Apple will start enforcing two-factor authentication for its developer accounts in February and we are trying to figure out how to best handle this.

We are currently a small team (fewer than 10 devs) and our clients will grant access to a single account we own. We will then login to that central account so we can access our apps in the clients' accounts. We currently have access to about 20 accounts. Now, I realize this is a poor security practice as you can't track who is actually accessing the account and making changes but we've stuck with it for the sake of flexibility.

We don't believe it feasible to ask a client to grant access to every single dev who needs access (most of the time, we have to sit on a screenshare with them just so they can figure out how...), nor does it seem possible for them to grant our central account access and then for our central account to grant our individual devs access. Additionally, when a dev leaves, we would then have to contact each client and ask that they remove access for that user (likely meaning we have to screenshare again; it could also be burdensome for the clients if we go through a period of high turnover or hiring).

With the introduction of the 2FA requirement, we need to determine how to change things going forward. The way I see it, we either have to go the extremely difficult route and grant each user access, stick to using the central account and share the 2FA codes as they are needed (meaning the primary user, likely me, would have to be available at all times...), or we'd have to only allow a single user to manage all Apple Apps (likely not feasible).

Is there an accept best practice or community standard we are overlooking for this so we can both improve our security and allow our devs to continue working as freely as they have been in the past? Am I overlooking some option that would allow us to grant access to our central account which then is granted access to client apps?

1
  • What kind of 2FA does apple implement? TOTP? SMS? Hardware TOTP?
    – vidarlo
    Dec 26 '20 at 18:32
0

One of the purposes of 2FA is to prevent the sharing of a single/central account by multiple members of a developer team, the way you say you have been doing.

Just considering issues you raised, with this kind of sharing model:

  • can't track who actually accessed the account and did some actions
  • when a developer leaves, they can still access the account, unless you change the password (and then everybody sharing the account need to be informed about the new password, except the developer who just left). It is all too easy to forget the change the password, and former developers could have such unauthorized access for months or years.

2FA helps to enforce better security. As you suggested, you may need to make some changes in your work processes, e.g., a single user (or maybe 2 or 3?) managing the admin management of the apps, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.