• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Skip to footer
  • Our Services
  • Contact Us
  • Newsletter
  • Top Nav Social Icons

Mobile ID World

Mobile ID World

Identification Revolution

  • Mobile ID
    • What Is Mobile ID?
    • Identity Associations
    • Premier Partners
    • FAQ
  • News
  • Solutions
    • Behavioral
    • Facial Recognition
    • Fingerprint Biometrics
    • Iris Biometrics
    • Second Factor
    • Smart Cards
    • Smartphones
    • Vital
    • Voice
    • Wearable Tech
    • Other
  • Applications
    • Access Control
    • Cloud Technology
    • Commerce
    • Enterprise
    • Healthcare
    • Identification
    • Internet of Things
    • Law Enforcement
    • Strong Online Authentication
  • Exclusive
    • Interviews
    • Featured Articles
    • Podcasts
  • Companies
  • Events

Apple Alters Autofill Function to Prevent SMS OTP Phishing

February 1, 2022

Apple is trying to make SMS One-Time Passcodes (OTP) a little more secure. To that end, the tech giant has followed through on an earlier proposal and changed the way that the code autofill function works in the latest iterations of its iOS, iPadOS, and macOS operating systems.

Apple Alters Autofill Function to Prevent SMS OTP Phishing

The changes were first introduced sometime around November, and were likely small enough to escape the notice of many users. As it stands, Apple users who activate SMS codes for two-factor authentication will receive a code via text message when they try to login to a site or an app with their Apple ID. That code would arrive in the form of a text message that read, “Your Apple ID Code is 123456. Don’t share it with anyone.” When the user started typing that code, Apple’s operating systems would autofill the most recent code that the user had received to speed up the authentication process.

The problem is that the autofill function still worked on the sites that cybercriminals set up to phish for login information, which made it easier for people to fall into traps. The update binds a passcode to one specific domain in order to thwart those efforts. Apple’s passcode messages now read, “Your Apple ID Code is: 123456. Don’t share it with anyone. @apple.com #123456 %apple.com”, with the second line of text referencing the domain and the iframe where the code is supposed to be entered.

In practice, the new system will feel much like the old one, as long as everything is legitimate. Users will receive a passcode, and Apple will autofill that code when it is used on the proper site. However, Apple will deactivate the autofill feature if the entry field does not match the domain specified in the text. If the code does not autofill, that should set off warning bells for end users, and prompt them to backtrack to make sure they aren’t being scammed.

The enhanced system was introduced with iOS 15, iPadOS 15, and macOS 11 Big Sur. While it is an improvement, it’s worth noting that it is not foolproof, and that SMS OTPs are still one of the most vulnerable two-factor authentication methods.

Sources: Macworld, XDA Developers

Filed Under: Industry News Tagged With: anti-phishing, Apple, Apple ID, AutoFill, Biometric, biometrics, iOS, iPadOS, macOS, one-time passcodes, OTP security

Related News & Articles

FPC’s Side-mounted Sensor to Debut in Low-cost 5G Phone

Carlström to Return to FPC as New Chairman

Repeat IDEX Customer Orders More TrustedBio Sensors for Biometric Cards

Primary Sidebar

Learn About Mobile ID and Aviation

Tweets

Sponsored Links

facetec logo

FaceTec’s patented, industry-leading 3D Face Authentication software anchors digital identity, creating a chain of trust from user onboarding to ongoing authentication on all modern smart devices and webcams. FaceTec’s 3D FaceMaps™ make trusted, remote identity verification finally possible. As the only technology backed by a persistent spoof bounty program and NIST/iBeta Certified Liveness Detection, FaceTec is the global standard for Liveness and 3D Face Matching with millions of users on six continents in financial services, border security, transportation, blockchain, e-voting, social networks, online dating and more. www.facetec.com

FACEPHI is a global leader in Facial Recognition technology and in Mobile Biometrics technologies. With a strong concentration in the financial sector, FacePhi’s product is rapidly becoming a service used by banks all over the world. Its implementation doesn’t just save money, it is also a way to attract clients and build loyalty, while increasing the security of transactions for both the customer and the business. To learn more about FacePhi, visit https://www.facephi.com/en/

Recent Posts

  • NordPass Enables Biometric, TOTP-secured 2FA for Business Users
  • Mastercard Solution Certified Under UK’s Digital ID Framework
  • Transatlantic Digital Traveler Identity Project Gets High-Profile Tech Partner
  • Digital Identity Tech Demo Online Event
  • Mobile ID Comes to Another US Campus

Footer

  • About Us
  • Company Directory
  • Advertise With Us
  • Contact Us
  • Privacy Policy
  • Terms of Use
  • Archives
  • CCPA: Do not sell my personal info.

Follow Us

Copyright © 2023 MobileIDWorld