• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Skip to footer
  • Our Services
  • Contact Us
  • Newsletter
  • Top Nav Social Icons

Mobile ID World

Mobile ID World

Identification Revolution

  • Mobile ID
    • What Is Mobile ID?
    • Identity Associations
    • Premier Partners
    • FAQ
  • News
  • Solutions
    • Behavioral
    • Facial Recognition
    • Fingerprint Biometrics
    • Iris Biometrics
    • Second Factor
    • Smart Cards
    • Smartphones
    • Vital
    • Voice
    • Wearable Tech
    • Other
  • Applications
    • Access Control
    • Cloud Technology
    • Commerce
    • Enterprise
    • Healthcare
    • Identification
    • Internet of Things
    • Law Enforcement
    • Strong Online Authentication
  • Exclusive
    • Interviews
    • Featured Articles
    • Podcasts
  • Companies
  • Events

Apple Alters Autofill Function to Prevent SMS OTP Phishing

February 1, 2022

Apple is trying to make SMS One-Time Passcodes (OTP) a little more secure. To that end, the tech giant has followed through on an earlier proposal and changed the way that the code autofill function works in the latest iterations of its iOS, iPadOS, and macOS operating systems.

Apple Alters Autofill Function to Prevent SMS OTP Phishing

The changes were first introduced sometime around November, and were likely small enough to escape the notice of many users. As it stands, Apple users who activate SMS codes for two-factor authentication will receive a code via text message when they try to login to a site or an app with their Apple ID. That code would arrive in the form of a text message that read, “Your Apple ID Code is 123456. Don’t share it with anyone.” When the user started typing that code, Apple’s operating systems would autofill the most recent code that the user had received to speed up the authentication process.

The problem is that the autofill function still worked on the sites that cybercriminals set up to phish for login information, which made it easier for people to fall into traps. The update binds a passcode to one specific domain in order to thwart those efforts. Apple’s passcode messages now read, “Your Apple ID Code is: 123456. Don’t share it with anyone. @apple.com #123456 %apple.com”, with the second line of text referencing the domain and the iframe where the code is supposed to be entered.

In practice, the new system will feel much like the old one, as long as everything is legitimate. Users will receive a passcode, and Apple will autofill that code when it is used on the proper site. However, Apple will deactivate the autofill feature if the entry field does not match the domain specified in the text. If the code does not autofill, that should set off warning bells for end users, and prompt them to backtrack to make sure they aren’t being scammed.

The enhanced system was introduced with iOS 15, iPadOS 15, and macOS 11 Big Sur. While it is an improvement, it’s worth noting that it is not foolproof, and that SMS OTPs are still one of the most vulnerable two-factor authentication methods.

Sources: Macworld, XDA Developers

Filed Under: Industry News Tagged With: anti-phishing, Apple, Apple ID, AutoFill, Biometric, biometrics, iOS, iPadOS, macOS, one-time passcodes, OTP security

Related News & Articles

Samsung Exec Stresses Security in IoT Observations

Samsung Brings Iris Scanning to Tablet Line

New Distributor to Market Zwipe Access Cards to Southern African Development Community

Primary Sidebar

Register For the Next Virtual Identity Summit

Register now!

Tweets

Sponsored Links

FACEPHI is a global leader in Facial Recognition technology and in Mobile Biometrics technologies. With a strong concentration in the financial sector, FacePhi's product is rapidly becoming a service used by banks all over the world. Its implementation doesn’t just save money, it is also a way to attract clients and build loyalty, while increasing the security of transactions for both the customer and the business. To learn more about FacePhi, visit https://www.facephi.com/en/

Recent Posts

  • FPC’s Optical In-display Sensor Gets First Design Win
  • FCC Tells Apple and Google to Get Rid of TikTok
  • Yubico Offers Subscriptions Through AWS Marketplace
  • Saskatchewan Privacy Commissioner Urges Development of Optional Digital ID
  • Wearable Authentication Company Closes $13 Million Funding Round

Footer

  • About Us
  • Company Directory
  • Advertise With Us
  • Contact Us
  • Privacy Policy
  • Terms of Use
  • Archives
  • CCPA: Do not sell my personal info.

Follow Us

Copyright © 2022 MobileIDWorld