In the market for an iPhone? Here's a breakdown of all the currently shipping iPhones from Apple.
Apple Engineers Propose Standardized Format for SMS One-Time Passcodes
Two-step verification logins require a user's password and another element that only the user would know – in this case, a one-time code sent via text message – to gain access to an online account.
As it stands, these SMS messages can arrive in a variety of formats, making it difficult or impossible for apps and websites to detect them and automatically extract their information.
Apple's proposal has two goals. The first is to introduce a way that one-time passcode SMS messages can be associated with the website, by adding the login URL inside the message itself.
The second goal is to standardize the format of the SMS messages, so that browsers and other apps can identify the incoming message, recognize the URL, and then extract the OTP code for automatic insertion into the appropriate login field on the website.
The idea behind automating OTP entry is that it eliminates the risk of users falling for a scam and entering an OTP code on a phishing site with a different URL.
Apple developers provided the following example of the new format SMS message for OTP codes:
747723 is your WEBSITE authentication code.The first line is intended for the user, enabling them to determine the website that the SMS OTP code came from, while the second line is processed by browsers and apps so that they can automatically extract the OTP code and complete the 2FA login operation.
@website.com #747723
If auto-complete fails, users will be able to check the URL of the website that sent the text against the site they're trying to log in to.
According to the report, Google Chrome engineers are already on board with Apple's proposal, but Mozilla's Firefox team have yet to provide official feedback on the standard.
The new proposals would add another layer of security to Apple's existing security code autofill feature, introduced in iOS 12, that can detect one-time passcodes in Messages and display them conveniently above the user's keyboard.
Top Rated Comments
(View all)They pile up.
Way to solve the problems of 10 years ago. Apple used to be more forward looking than this.
If the problems of ten years ago aren’t solved yet that makes them the problems of today.
I could likely get my mother to use 2FA by sms but I’d never be able to convince her of carrying around an Authenticator device or using a keygen app. If we have the opportunity, shouldn’t we refine all options?
If Apple is pushing for standards, why not standardize a proper 2FA protocol (e.g., OATH) and require all smartphones to have a standard compatible authenticator app built-in?
Indeed, I bet Apple could do it by themselves if they just bundle a 2FA app into iOS using a common open protocol. It's hard to get users to downloading Authy or similar app, but if its built-in it will take off. Service providers will be incentivized to adopt that protocol so their 2FA can be native in iOS, and the Androids will copy Apple as they always do.
The way iOS captures the text code and fills it automatically is so convenient. It’s one of those little features that just makes things a bit easier and I smile every time it does it.
Actually, not being able to select and copy text from messages is extremely annoying, like when someone sends you someones phone number or email address but doesn't leave a space before and after it... The bane of my existence.
In 2020 sites should be using and supporting TOTP codes like those provided by Authy or even better Yubikeys and the like. SMS two-factor is vulnerable to mobile provider compromise, and these attacks have occurred in the wild for high value targets like crypto wallets.
This prevents them stacking up in your recent messages and is a overall cleaner look.
If the problems of ten years ago aren’t solved yet that makes them the problems of today.
I could likely get my mother to use 2FA by sms but I’d never be able to convince her of carrying around an Authenticator device or using a keygen app. If we have the opportunity, shouldn’t we refine all options?
But, if we are pushing people to unsafe options, then we are doing them a disservice. The fact that this still uses SMS as a delivery mechanism makes it less safe than other methods.
To me, I always want to use the safest option. In order:
1) Hardware Key (which is rare)
2) Soft/Hardware Key - Approval requests are sent to an app on my phone and I have to approve them there. (Best apps are ones that allow approval directly from the notification after I authenticate.)
3) TOTP - 1 Password makes using TOTP so much easier.
4) SMS - Better than nothing, but becoming less safe these days.
5) Nothing.
[ Read All Comments ]







Apple's head of business for Apple News+, Liz Schimel, has departed the company less than a year after the $9.99 per month service launched, reports Bloomberg.
Schimel was responsible...
Every year in February, Apple hosts a company wide fitness challenge for all of its employees at its corporate and retail offices around the world.
Employees are tasked with closing all three of...
Twitter this week updated its Twitter for Mac app, introducing improved Touch Bar support for those who have a Mac with a Touch Bar.
According to the release notes for the update, it includes...
Microsoft today updated its Outlook app with full support for Split View on compatible iPad models, allowing users to multitask in a variety of ways, such as having an email and calendar open side by...
Amazon and B&H Photo have new sales on the 21.5-inch and 27-inch iMac from Early 2019, discounting a few models by up to $200. The centerpiece of the sale is the 27-inch 5K model with a...
Google has emailed some users of Google Photos to inform them that some of their private videos were accidentally sent to strangers, reports 9to5Google.
The "technical issue" is said to...
Apple is in negotiations with financial institutions in the Middle East to bring Apple Pay to Israel, reports the regional Calcalist website.
According to the Hebrew-language publication,...



