4 ms·
What does this SMS autofill API do? I've never heard of it and wonder if it's needed.
by pvorb 7y ago
What does this SMS autofill API do? I've never heard of it and wonder if it's needed.
- t0mas88 7y agoOne use is when you have to verify your phone number for something like WhatsApp, they send you a text and Google Play will detect receiving it and skip the step where you enter the code in the app. So it's a very minor inconvenience that you now have to type a few digits from an SMS instead of that happening automatically.
- cmroanirgo 7y agoBut if you think about it, WhatsApp needing your sms is a dark anti pattern anyway: the only time it needs sms is to uniquely identify you /provide you with an account. A username/pwd combo does that too. WhatsApp doesn't (or didn't, last time I used it a few years back) need sms access, let alone your phone number.
- tripzilch 7y agoThe alternative is not giving WhatsApp access to SMS, but receiving the SMS via normal means, and then entering the 5 digit code manually. My prediction: If people stop allowing this feature becomes even slightly popular, they're gonna use longer codes "for security".
- ohithereyou 7y agoWhatsApp is owned by Facebook, and Facebook must know all.
- thebean11 7y agoMy understanding was that WhatsApp doesn't gain access to SMS, the Google API gives WhatsApp the code only.
- izacus 7y agoThis "very minor" convenience also verifies sender signature to help avoid spoofing and phishing attacks and thus improves security. It was deemed important enough that Apple followed by implementing the API in iOS12.
- scambier 7y agoHow so? Does it do more than autofill?
- izacus 7y agoThe SMS needs to be signed on the server-side with the apps private key. Play Services verifies the signature before it passes the OTP key to the app. https://developers.google.com/identity/sms-retriever/verify https://developers.google.com/identity/sms-retriever/verify
- briandear 7y agoiOS has that and it doesn’t require some weird permission granted to a third party such as Google.
- izacus 7y agoDid you think for a second before you wrote your statement? How is Google a third party in their own operating system when implementing OS APIs?
- izacus 7y agoIt hangles SMS-based OTP authentication automatically - it grabs the OTP token and passes it to an app so the app doesn't have to require SMS access or ask user to retype the code. It also verifies the source of the SMS.