In the market for an iPhone? Here's a breakdown of all the currently shipping iPhones from Apple.
Apple Engineers Propose Standardized Format for SMS One-Time Passcodes
Apple WebKit engineers have put forward a proposal to make one-time passcode SMS messages more secure by developing a standardized format for the two-step verification process, reports ZDNet.
Two-step verification logins require a user's password and another element that only the user would know – in this case, a one-time code sent via text message – to gain access to an online account.
As it stands, these SMS messages can arrive in a variety of formats, making it difficult or impossible for apps and websites to detect them and automatically extract their information.
Apple's proposal has two goals. The first is to introduce a way that one-time passcode SMS messages can be associated with the website, by adding the login URL inside the message itself.
The second goal is to standardize the format of the SMS messages, so that browsers and other apps can identify the incoming message, recognize the URL, and then extract the OTP code for automatic insertion into the appropriate login field on the website.
The idea behind automating OTP entry is that it eliminates the risk of users falling for a scam and entering an OTP code on a phishing site with a different URL.
Apple developers provided the following example of the new format SMS message for OTP codes:
If auto-complete fails, users will be able to check the URL of the website that sent the text against the site they're trying to log in to.
According to the report, Google Chrome engineers are already on board with Apple's proposal, but Mozilla's Firefox team have yet to provide official feedback on the standard.
The new proposals would add another layer of security to Apple's existing security code autofill feature, introduced in iOS 12, that can detect one-time passcodes in Messages and display them conveniently above the user's keyboard.
Two-step verification logins require a user's password and another element that only the user would know – in this case, a one-time code sent via text message – to gain access to an online account.
As it stands, these SMS messages can arrive in a variety of formats, making it difficult or impossible for apps and websites to detect them and automatically extract their information.
Apple's proposal has two goals. The first is to introduce a way that one-time passcode SMS messages can be associated with the website, by adding the login URL inside the message itself.
The second goal is to standardize the format of the SMS messages, so that browsers and other apps can identify the incoming message, recognize the URL, and then extract the OTP code for automatic insertion into the appropriate login field on the website.
The idea behind automating OTP entry is that it eliminates the risk of users falling for a scam and entering an OTP code on a phishing site with a different URL.
Apple developers provided the following example of the new format SMS message for OTP codes:
747723 is your WEBSITE authentication code.The first line is intended for the user, enabling them to determine the website that the SMS OTP code came from, while the second line is processed by browsers and apps so that they can automatically extract the OTP code and complete the 2FA login operation.
@website.com #747723
If auto-complete fails, users will be able to check the URL of the website that sent the text against the site they're trying to log in to.
According to the report, Google Chrome engineers are already on board with Apple's proposal, but Mozilla's Firefox team have yet to provide official feedback on the standard.
The new proposals would add another layer of security to Apple's existing security code autofill feature, introduced in iOS 12, that can detect one-time passcodes in Messages and display them conveniently above the user's keyboard.
[ 68 comments ]
Top Rated Comments
(View all)
3 weeks ago
The way iOS captures the text code and fills it automatically is so convenient. It’s one of those little features that just makes things a bit easier and I smile every time it does it.
3 weeks ago
Way to solve the problems of 10 years ago. Apple used to be more forward looking than this.
If the problems of ten years ago aren’t solved yet that makes them the problems of today.
I could likely get my mother to use 2FA by sms but I’d never be able to convince her of carrying around an Authenticator device or using a keygen app. If we have the opportunity, shouldn’t we refine all options?
3 weeks ago
2FA using SMS is better than nothing, but is not very secure because of how SMSs can be intercepted.
If Apple is pushing for standards, why not standardize a proper 2FA protocol (e.g., OATH) and require all smartphones to have a standard compatible authenticator app built-in?
Indeed, I bet Apple could do it by themselves if they just bundle a 2FA app into iOS using a common open protocol. It's hard to get users to downloading Authy or similar app, but if its built-in it will take off. Service providers will be incentivized to adopt that protocol so their 2FA can be native in iOS, and the Androids will copy Apple as they always do.
If Apple is pushing for standards, why not standardize a proper 2FA protocol (e.g., OATH) and require all smartphones to have a standard compatible authenticator app built-in?
Indeed, I bet Apple could do it by themselves if they just bundle a 2FA app into iOS using a common open protocol. It's hard to get users to downloading Authy or similar app, but if its built-in it will take off. Service providers will be incentivized to adopt that protocol so their 2FA can be native in iOS, and the Androids will copy Apple as they always do.
3 weeks ago
It’s a very Apple like proposal - it just works.
The way iOS captures the text code and fills it automatically is so convenient. It’s one of those little features that just makes things a bit easier and I smile every time it does it.
3 weeks ago
Yes please! I hate it when making a payment, your bank sends the text but you can only copy the entire message as a whole so you have to remember it. And the code expires after a few seconds.
Actually, not being able to select and copy text from messages is extremely annoying, like when someone sends you someones phone number or email address but doesn't leave a space before and after it... The bane of my existence.
Actually, not being able to select and copy text from messages is extremely annoying, like when someone sends you someones phone number or email address but doesn't leave a space before and after it... The bane of my existence.
3 weeks ago
Way to solve the problems of 10 years ago. Apple used to be more forward looking than this.
In 2020 sites should be using and supporting TOTP codes like those provided by Authy or even better Yubikeys and the like. SMS two-factor is vulnerable to mobile provider compromise, and these attacks have occurred in the wild for high value targets like crypto wallets.
In 2020 sites should be using and supporting TOTP codes like those provided by Authy or even better Yubikeys and the like. SMS two-factor is vulnerable to mobile provider compromise, and these attacks have occurred in the wild for high value targets like crypto wallets.
3 weeks ago
This feature is one of a stack of reasons why I prefer Safari over other browsers - I haven’t had an issue with iOS or macOS detecting the code and offering to insert it without me leaving the browser. It’s seamless and feels magical.
3 weeks ago
How about iOS auto detects that if it's an Authentication SMS, it shows it as a Notifcation Alert instead?
This prevents them stacking up in your recent messages and is a overall cleaner look.
This prevents them stacking up in your recent messages and is a overall cleaner look.
3 weeks ago
If the problems of ten years ago aren’t solved yet that makes them the problems of today.
I could likely get my mother to use 2FA by sms but I’d never be able to convince her of carrying around an Authenticator device or using a keygen app. If we have the opportunity, shouldn’t we refine all options?
But, if we are pushing people to unsafe options, then we are doing them a disservice. The fact that this still uses SMS as a delivery mechanism makes it less safe than other methods.
To me, I always want to use the safest option. In order:
1) Hardware Key (which is rare)
2) Soft/Hardware Key - Approval requests are sent to an app on my phone and I have to approve them there. (Best apps are ones that allow approval directly from the notification after I authenticate.)
3) TOTP - 1 Password makes using TOTP so much easier.
4) SMS - Better than nothing, but becoming less safe these days.
5) Nothing.
[ Read All Comments ]
Amazon is discounting a few models of the latest 2019 iMac, including 21.5-inch and 27-inch models. These sales offer up to $150 off the iMac, and each discount has been automatically applied so...
Instagram CEO Adam Mosseri took to the platform over the weekend to answer a few user questions on his story, shared by The Verge's Chris Welch. Among the many things asked, the topic of an...
Lockdown, a popular open source firewall app that's designed to let users block any connection to any domain, is now available for Macs in addition to iOS devices.
Launched on the iPhone...
Apple touts that there are now over 500 car models supporting CarPlay, and Nissan's luxury brand Infiniti is one of the most recent (and perhaps the last significant brand in the U.S. other than...
For this week's giveaway, we've teamed up with Waterfield Designs to offer MacRumors readers a chance to win a pocket-laden Air Duffel Carry-On Bag for carrying your Mac, iPad, iPhone, and...
This Presidents' Day weekend you can save on a few iOS and macOS apps at StackSocial, offering you an extra 15 percent off apps that have already been discounted. These include a VPN, website...
Enter the chaotic world of Lincoln Loud and his sisters in "Loud House: Outta Control," this week's addition to Apple Arcade across the iPhone, iPad, and Apple TV. Based on the...
Best Buy today kicked off a new weekend sale, this one timed to end on Monday at 11:59 p.m. CT, which is Presidents' Day in the United States. There are a few Apple products and accessories...
