Apple is trying to make SMS One-Time Passcodes (OTP) a little more secure. To that end, the tech giant has followed through on an earlier proposal and changed the way that the code autofill function works in the latest iterations of its iOS, iPadOS, and macOS operating systems.
The changes were first introduced sometime around November, and were likely small enough to escape the notice of many users. As it stands, Apple users who activate SMS codes for two-factor authentication will receive a code via text message when they try to login to a site or an app with their Apple ID. That code would arrive in the form of a text message that read, “Your Apple ID Code is 123456. Don’t share it with anyone.” When the user started typing that code, Apple’s operating systems would autofill the most recent code that the user had received to speed up the authentication process.
The problem is that the autofill function still worked on the sites that cybercriminals set up to phish for login information, which made it easier for people to fall into traps. The update binds a passcode to one specific domain in order to thwart those efforts. Apple’s passcode messages now read, “Your Apple ID Code is: 123456. Don’t share it with anyone. @apple.com #123456 %apple.com”, with the second line of text referencing the domain and the iframe where the code is supposed to be entered.
In practice, the new system will feel much like the old one, as long as everything is legitimate. Users will receive a passcode, and Apple will autofill that code when it is used on the proper site. However, Apple will deactivate the autofill feature if the entry field does not match the domain specified in the text. If the code does not autofill, that should set off warning bells for end users, and prompt them to backtrack to make sure they aren’t being scammed.
The enhanced system was introduced with iOS 15, iPadOS 15, and macOS 11 Big Sur. While it is an improvement, it’s worth noting that it is not foolproof, and that SMS OTPs are still one of the most vulnerable two-factor authentication methods.
Sources: Macworld, XDA Developers
Follow Us