[vitamen]

So "This is a very common attack on the Internet that we didn't do much to protect you against by default"?

It's a pain setting up two step authentication across a lot of services, but I guess iCloud is probably one that's worth the effort. Still I'd rather brute force was not an option.

[sp332]

The recently fixed "find my phone" feature doesn't support two-factor auth because, presumably, you can't find your phone to get the second factor.