4 ms·

The thing is most normal users don't really want random apps to be able to provide OTPs. While it would be nice to have an API for every system functionality li

The thing is most normal users don't really want random apps to be able to provide OTPs. While it would be nice to have an API for every system functionality like reminders where every app is allowed to register as the reminder app, it would necessitate far more complexity and far slower pace of development on the reminder interfacing. This is where there is a big difference in what the ultra few power users want and what normal users want. Ultra power users want to be able to install an app file for a random app with app store like experience and with as less hurdles as possible, while normal users are very scared of receiving an apk file in whatsapp and installing it by mistake (there is a spectrum here and it's not binary).

yunohn 2y ago
You don’t need to invent a “random apps” strawman. Apple already restricts which apps can be used as default mail/browser, just allow them access to the same APIs. Why not at least Gmail, Chrome, and gBoard? Millions of “non power users” use these apps over Apple’s offering.
HumblyTossed 2y ago
> The thing is most normal users don't really want random apps to be able to provide OTPs. You're right! But most normal users DO really want the app they CHOOSE to be able to provide OTPs!
- crop_rotation 2y ago
  They do, but they also want to be safe from being able to choose unexpectedly and doing this in a way that both protects the user and gives them choices is hard. I also want mobile OSes to be flexible but they should always err on the side of caution given most of their users don't have time and energy to understand how to use such features safely and correctly.
  - yunohn 2y ago
    Could you explain the security problem you foresee? The Gmail app already has received an email which has the OTP in it. Why can’t it provide that to your keyboard? What’s the vulnerability here?
    - crop_rotation 2y ago
      I used to think similarly. However in the past 4-5 years I have observed closely my non tech family member's usage of smartphones and they frequently install totally random apps, they have no idea what their default browser/keyboard is at any moment or how to change it and who frequently receive apks on whatsapp and almost always click on it (only the android hurdle against apks protects them) so on. Sure it might be fine for gmail to write OTP but what about abcdmail, what about go pro SMS style apps. I think there is a fine balance here between flexibility and non tech user safety.

yunohn 2y ago

You don’t need to invent a “random apps” strawman. Apple already restricts which apps can be used as default mail/browser, just allow them access to the same APIs. Why not at least Gmail, Chrome, and gBoard? Millions of “non power users” use these apps over Apple’s offering.

HumblyTossed 2y ago

> The thing is most normal users don't really want random apps to be able to provide OTPs. You're right! But most normal users DO really want the app they CHOOSE to be able to provide OTPs!

crop_rotation 2y ago
They do, but they also want to be safe from being able to choose unexpectedly and doing this in a way that both protects the user and gives them choices is hard. I also want mobile OSes to be flexible but they should always err on the side of caution given most of their users don't have time and energy to understand how to use such features safely and correctly.
- yunohn 2y ago
  Could you explain the security problem you foresee? The Gmail app already has received an email which has the OTP in it. Why can’t it provide that to your keyboard? What’s the vulnerability here?
  - crop_rotation 2y ago
    I used to think similarly. However in the past 4-5 years I have observed closely my non tech family member's usage of smartphones and they frequently install totally random apps, they have no idea what their default browser/keyboard is at any moment or how to change it and who frequently receive apks on whatsapp and almost always click on it (only the android hurdle against apks protects them) so on. Sure it might be fine for gmail to write OTP but what about abcdmail, what about go pro SMS style apps. I think there is a fine balance here between flexibility and non tech user safety.