Russell Ivanovic from Shifty Jelly in a post about Apple’s response to the recent celebrity ‘hacks’:
…Apple forgets to mention that there’s no such thing as two-step authentication for your iCloud photos, or even access to your iCloud account.
It’s so true; there’s very little in iCloud which actually prompts you to enter your 2-factor code. It’s a weird disconnect; a company that’s shipped tens of millions of biometric sensors to improve local device security, but will let you log in to a new device and suck everything down without asking for any other verification other than password.