**UPDATE 09/07/2014**

Find out why apple's sloppy implementation of 2FA wouldn't actually have helped very much by reading here:

http://nakedsecurity.sophos.com/2014/09/04/apple-please-provide-better-protection-for-icloud-and-secure-our-selfies/

Apple apparently plans to fix this in coming weeks.

I woke up this morning and my twitter stream was on fire about a new celebrity nude photo leak. Jennifer lawrence, and up to 100 other celebrities have had their nude photographs leaked online. These were claimed to have been obtained from compromised icloud accounts. Apple does a great job of storing data, which means that the icloud data is encrypted on apple's servers and encrypted when transmitted to and from the server. The only way I can think of that this data could have been accessed is if someone learned the login credentials for the icloud accounts in question. 

Of course, not storing nude photographs of yourself online is the safest way to ensure that you're not at risk for such a compromise, and most of us are pretty low profile targets for hackers. However, when it comes to security it would be foolish not to take simple precautions when possible. Services make using, sharing, and sorting data a lot easier, but it can come at the cost of privacy. For example, your phone automagically includes your location data and uploads the photographs to the cloud. This is great for sorting through photographs by location, but that data stays with the image no matter where it's sent. So for example, if you upload your photo to instagram or twitter, it could contain location data which can be read by anyone with a browser plugin. 

Some have suggested an incognito camera mode which would keep pictures taken in that mode from being uploaded to the cloud. Right now that doesn't exist. Had Jennifer Lawrence simply enabled two factor authentication on her icloud account, she would have most likely avoided this whole situation. 

Two Factor Authentication uses your cell phone number or an authenticator app to verify a log in attempt. A ton of different services offer it and it works really well. It's a slight pain to wait 2 seconds for the code to show up in your text messages, but a hacker attempting to gain access to your account would need your username, password, and access to your phone. 

To enable it, you provide your phone number to the service and they send you a test message, once verified any future attempts to log in to your account from an untrusted device will require the user to enter a new code generated and sent via text message (or using an authenticator app). 

You can visit the Two Factor Auth list for a comprehensive collection, or visit Evan Hahn's website for a pretty good list. Popular services that offer two factor are gmail, dropbox, box.net, icloud, facebook, wordpress, godaddy, evernote, paypal, and twitter. There are dozens more, even small time local banks are offering it.