Advanced Data Protection Support #202
Comments
|
@gsong are you using iCloud Shared Photo Library? |
No, I'm not. |
|
I'm in a similar position with advanced data protection and a yubikey on my Apple ID. With this combination of security settings, the sign in prompts I receive on other devices don't have MFA codes, but rather just "ok" or "that wasn't me". Edit; this feels like something that might have a soft dependency on #120 to do yubikey auth via a webUI. |
|
@gsong Any of those things enabled with you as well?
|
|
I just realise I was skipping over this part @gsong
You will need to make sure that access through the iCloud WebUI is enabled. See Apple's support document on this. The tool is re-using those APIs (and I hope the APIs are the same when this is enabled, since I cannot test this). Please report back - in case it does not work, I would need to ask the same of you as above. |
steilerDev
added
class(known issue)
steilerDev
added
the
status(help needed)
steilerDev
removed
the
status(investigating)
|
Hiya, I'm trying to set this tool up and I have Advanced Data Protection enabled on my iCloud account. I'm currently getting the following error when I try running the I've made sure that I have the "Access iCloud Data on the Web` option enabled in my account settings. Let me know if I could provide you with more information to help troubleshoot this as I do not want to disable ADP. |
|
@noah-guillory which 2FA method are you using. Does the WebUI access work (have you ever accessed the UI from a non Safari browser, where you provided password instead of Touch ID) |
I am using the normal 2FA method, not using any hardware security keys or anything. I was able to get through the process of providing my 2FA code by And I am able to access Photos from the WebUI using Edge as well. Though whenever I do, I do get a push notification on my Mac saying that my device is providing access to the iCloud web interface. |
|
Do you need to confirm this notification before being able to continue? |
|
I need to understand how the API behaves differently from the current process, when ADP is enabled. Best way for me to debug is by being able to see the iCloud API's behaviour here. For that I'd need a HAR file of your login on the browser. For that do the following:
Example of how to do this: create-har-h265.mp4 |
|
Makes sense! Whenever I get a chance I'll get you that file. Thanks for being responsive 😄 |
|
Hi @steilerDev, is there any hope of ADP support landing soon? Did you get the input you needed? |
|
@Tomfox91 unfortunately I have not received any feedback on my previous request - so I have not had the chance to implement this. |
|
Thanks @Tomfox91 for sending over an HAR file - I just had a quick look - some things look different, but the good news is that the API is very close to what I am expecting :) Unfortunately I'm not sure when I'll get around working on this as private and professional life are currently taking a lot of time :/ Anyone who wants to support on this, I'm happy to point you into directions :) |
|
Sadly I think the resolution to this issue is to buy a used / refurb m1 Mac mini. |
steilerDev
added
class(feature)
|
I tried a sync using I can also confirm that "Access iCloud Data on the Web" option is enabled in my account settings. |
|
See foxt/icloud.js#4 for some research done on this topic |
steilerDev
removed
the
status(help needed)
|
1.4.0-nightly.1 should contain ADP support! |
|
This issue should be resolved with version v1.4.0-beta.1, please confirm. |
github-actions
bot
added
the
status(previewed)
|
I tested nightly (v.1.4.0-nightly.4!), was able to authenticate, got half a dozen "Your Apple ID was used to sign in to iCloud via a web browser" emails from apple, but sync command fails: |
|
Some additional information. I waited some time and tried again. Now works fine. Maybe since it tried a couple of times so fast and I hadn't had enough time to authorize on the phone, then it was banned for a while. So maybe you ought to not try in a busy loop.. |
|
Yeah - it seems Apple is quite quickly at limiting authentication requests when ADP is enabled - I've ran into the 500 issue as well when testing. I might adjust the retry timeout - that's good feedback |
|
Hmm... I just tried both the nightly and the beta, but I always get: and then it stops. On my iPhone, I get a notification that my icloud account is being logged in, but without asking me to allow it. When accessing iCloud on the web, I get a similar notification, but with an "allow" button, and then it works fine. |
|
Before ADP kicks in, you will need to provide your MFA code - this is a 6-digit code either pushed to your iDevice or phone number. See in the docs on how to submit the code to the app: https://icps.steiler.dev/get-started/#submit-mfa-code |
|
Thanks for the quick answer. I never got a code like that on my iPhone or Mac. Maybe because i have two yubikeys as 2FA, which I usually need for login? (Although I have two trusted phone numbers defined as well...) |
|
Ahh - Yubikey authentication is currently out of scope (since I don't have an account setup with this and I don't own one) - if you've got trusted phone numbers you can have the MFA code resent to them: https://icps.steiler.dev/get-started/#re-send-mfa-code - just provide method 'sms' and a phone number id (those start at 0 and go up - it depends on how many you've got, but they should provide an error if the id is invalid) |
|
Oh, thanks! So I tried running "docker exec photos-sync resend_mfa sms 0", but I get: Do you think it's possible that SMS 2FA is disabled by Apple when security keys are used? |
|
Can you try with id 1/2/3...? I know that deleting and re-adding a phone number will increase this id (my demo account always needs id '3' for some reason :D ) |
|
I tried up to 6, no luck. Looking at https://discussions.apple.com/thread/254617891?sortBy=best it seems weaker options (like SMS) are disabled when security keys are added. Too bad... seems I have to make a choice between backups and strong security 😅 |
|
Could be - to double check, you could use the PostMan collection (https://github.com/steilerDev/icloud-photos-sync/tree/main/docs/postman). You could add your cred. and then run 01-Enter Password followed by 01--- Get list of devices (this will give you all options available for MFA) |
|
Just tried this, and I get: |
|
I guess that means no SMS? |
|
I'm afraid so :/ I'm getting something like this: Unfortunately I have no idea how much work it would be to implemented - but based on a previous provided capture of a yubi key flow, it did not seem straight forward :/ Nevertheless, I'd welcome you taking a shot |
|
OK, in any case, thanks a lot for your help! |
|
Any news on this? When I try |
|
@maartenhendrix have you enabled "Access iCloud data on the web"? This is necessary for the tool to read the Photo Library data. |
|
@steilerDev sorry about that. It was not enabled. Works now. Thank you very much for the great tool! |
|
A bit late to the game in providing feedback on this, but using |
|
As this issue is still open, I'd like to report that syncing photos worked flawlessly for me using 1.4.0-beta.1 with ADP enabled. Thanks a lot! |
|
It works for me … for one hour. Then fails. I retried twice more, and both times failed at 59mXXs. |
|
@pudge this is unfortunately a limitation of the API (staging docs):
This re-authorization is handled when ADP is off and uses a cached trust token - ADP requires approval of the data access. This should however only matter with the initial sync (which will probably have to load a ton of data) - the sync is incremental and existing data will not be deleted |
a. I did not get a request to re-authorize (I was watching it at the time) So each retry, I would be left with only a small handful of kept assets. After running through this four times (x10 “retries” each time), it kept only 109 local assets. |
|
Do you have Advanced Data Protection enabled? Looking at the logs, it seems this is unrelated to this issue (as the re-sync errors quickly with a different error) - I think it's best to track your issue in a separate ticket. I will lock this issue for now - it will be closed once I've released the stable release of ADP support with the next public release (which I should probably do soon). |
Describe the bug
Note that I do have Advanced Data Protection turned on.
Logs
Please paste the log file (preferably with
LOG_LEVEL=debug), located in.icloud-photos-sync.log, stored in the DATA_DIR.Operating environmnent
The text was updated successfully, but these errors were encountered: