Secure login with iCloud Keychain verification codes

RSS for tag

Discuss the WWDC21 session Secure login with iCloud Keychain verification codes.

Posts under wwdc21-10105 tag

10 Posts

Post

Replies

Boosts

Views

Activity

Save Password dialogue not triggered in wkWebView
The Save Password / KeyChain dialogue is not presented upon entry of credentials in a wkWebView authorization view. While the domain is properly entitled and the KeyChain auto-fill does appear to FILL credentials that may already exist from Safari, the save user/password dialogue never displays on a change or if no prior credentials exist in Safari. Is this expected behavior? Clearly the entitlement of the domain allows the auto-fill to function properly.
0
0
1.4k
May ’22
iOS 15 Password Manager / Authenticator opens on all "otpauth://" URL's without the "apple-" prefix
When attempting to open an otpauth://totp URL on iOS 15 Beta 8 it opens the Password Manager. Based on the documentation & the tagged WWDC session it should only open the iOS Password Manager if the URL contains the apple- prefix. For example: apple-otpauth://totp This is currently breaking our Multi Factor Authentication setup flow. Will this behaviour be changed for the next beta & iOS 15 release?
5
0
3.1k
Apr ’22
Write Permissions Error (-61) returned by SecItemAdd() Objective-C API
The Keychain API SecItemAdd() returns -61 status code. Programming Language: objective-c OS: Mac BigSur 11.6.3 Default keychain: /Users/user_name/Library/Keychains/login.keychain-db Ownership: UID and GID of logged in user match those of the keychain Status of keychain as reported by SecKeychainGetStatus(): 7 (unlocked + read-permission + write-permission) Test runs fine in local environment but fails in CI environment
1
0
1.5k
Apr ’22
Failed to access keychain after app update
First, I would like to make an apology for my naive question. I am working on an iOS app where I have a database key that I need to store in the keychain. I also have other's framework modules that need to access the keychain. My app doing pretty well before the app update. After the app update, I need to change my DB(database) key for some reason. So I need to update my DB key in the keychain. But when I tried to store my DB key in the keychain I am getting the error code -25299. After that error, my other keychain dependant's framework also couldn't access the keychain. My query is, how to overcome this issue?
0
0
1.6k
Feb ’22
Do Verification code generated using otpauth url in iPhone device password app gets autofill in app UITextField ?
I am working on a small PoC on iCloud Key Chain Secure Login with Verification code after going through this video. WWDC 2021 video, Secure Login with iCloud KeyChain I am using my github account credentials to generate 2 facor authentication : Otpauth url which I am using is : "apple-otpauth://totp/Github:MyGithubUserName?"+"secret=IssuerSecretKey&digits=6&period=30&issuer=github.com" Steps which I am following : Deleted 2 factor from my GitHub account on browser and deleted google authenticator app fro, iphone device. Added my GitHub credentials in device settings - password app In demo project, I have added one textfield and one button, textfield content type is .oneTimeCode and keyboard type as number pad. Added above mentioned hardcoded GitHub otpauth url on button tap which navigates to password app and generate verification code. Issue which I am facing is, Verification code is generated in device >> settings >> password section, but that verification code is not automatically get pasted in app textfield. Quickbar is not enabled for the Textfield for verification code. My UITextfield code is : securityCodeTextField.textContentType = .oneTimeCode securityCodeTextField.autocorrectionType = .no If I change textField to .userName then userName gets automatically filled in UITextfield. Kindly help me what I am missing.
0
0
761
Dec ’21
How to differentiate between SMS OTP and Timed-OTP on a web page
To secure a login page, we want to ask users for either an OTP code sent via SMS to their registered cell phone or a Timed-OTP validation code paired with their account. On the form, we would tag the input field for the SMS OTP with "autocomplete=one-time-code" and it should be filled with the token received via SMS. The other input field for the Timed-OTP code would also need to be tagged with the same attribute (according to the newly introduced method to embed TOTP inside of the KeyChain). Now if the user clicks in any of those fields, the SMS OTP value or TOTP value is available as a selection, leading to a confusion which to enter where. Normally, the user would only have one method chosen, so only one field would appear, however, this is not enforced. Is it somehow possible to only show the SMS codes in one field and the Timed-OTP codes in the other?
0
0
739
Oct ’21
ssl revoked after last Monterey update
I have a certificate from „eBlocker“ on my two mac systems ( both now at macOS 12.0 Monterey (21A5284e) ). I have set, as per instructions from eBlocker, the „Secure Sockets Layer (SSL)“ to „immer vertrauen“ (always trust). I updated my MacBook overnight and the next day eBlocker would not work anymore. So I finally checked the certificate, and it was reset to default. Strange, but who knows why it happened. So before running the update on my iMAC, I checked on the certificate there. It was set correctly. So I started the update and immediately after it was installed, I checked on the certificate, it was reset to default. I actually made screenshots, but all they show, is the reset SSL. The people at eBloker are not taking me seriously, but believe, that this just can not be. I would not think so either, but it did happen. And twice at that! I sure hope you have an idea, how this could be happening. I did use the Feedback-Assistent to let APPLE know. Thought this might get me a faster answer. Thanks in advance from Mannheim, Germany. Sorry, could not "find" a fitting tag.
2
0
1.3k
Aug ’21
Does TOTP autofill actually work in iOS 15 beta 2?
I tried following the setup described in the WWDC21-10105 video, but the autofill suggestion does not appear above the keyboard as shown at 6:17 in video. With the same account, password autofill works. I was able to create a setup button to add a TOTP entry to the account. It bounces me to the Password area of Settings, and I can associate the TOTP with my account. But the verification code auto-suggestion does not appear in my app despite adding the UITextContentType.oneTimeCode attribute to my UITextField. Btw, I was hoping that the setup experience would happen in-app instead of getting bounced to Settings. I'm noticing also that the video has a text input keyboard, instead of numeric, which is odd because the TOTP input is actually restricted to 6 or 8 digits anyway.
1
0
1.7k
Jul ’21
Save Password dialogue not triggered in wkWebView
The Save Password / KeyChain dialogue is not presented upon entry of credentials in a wkWebView authorization view. While the domain is properly entitled and the KeyChain auto-fill does appear to FILL credentials that may already exist from Safari, the save user/password dialogue never displays on a change or if no prior credentials exist in Safari. Is this expected behavior? Clearly the entitlement of the domain allows the auto-fill to function properly.
Replies
0
Boosts
0
Views
1.4k
Activity
May ’22
iOS 15 Password Manager / Authenticator opens on all "otpauth://" URL's without the "apple-" prefix
When attempting to open an otpauth://totp URL on iOS 15 Beta 8 it opens the Password Manager. Based on the documentation & the tagged WWDC session it should only open the iOS Password Manager if the URL contains the apple- prefix. For example: apple-otpauth://totp This is currently breaking our Multi Factor Authentication setup flow. Will this behaviour be changed for the next beta & iOS 15 release?
Replies
5
Boosts
0
Views
3.1k
Activity
Apr ’22
Write Permissions Error (-61) returned by SecItemAdd() Objective-C API
The Keychain API SecItemAdd() returns -61 status code. Programming Language: objective-c OS: Mac BigSur 11.6.3 Default keychain: /Users/user_name/Library/Keychains/login.keychain-db Ownership: UID and GID of logged in user match those of the keychain Status of keychain as reported by SecKeychainGetStatus(): 7 (unlocked + read-permission + write-permission) Test runs fine in local environment but fails in CI environment
Replies
1
Boosts
0
Views
1.5k
Activity
Apr ’22
request demo app source
Please tell me the link of source code and project of this shiny app.
Replies
3
Boosts
0
Views
1.4k
Activity
Apr ’22
Failed to access keychain after app update
First, I would like to make an apology for my naive question. I am working on an iOS app where I have a database key that I need to store in the keychain. I also have other's framework modules that need to access the keychain. My app doing pretty well before the app update. After the app update, I need to change my DB(database) key for some reason. So I need to update my DB key in the keychain. But when I tried to store my DB key in the keychain I am getting the error code -25299. After that error, my other keychain dependant's framework also couldn't access the keychain. My query is, how to overcome this issue?
Replies
0
Boosts
0
Views
1.6k
Activity
Feb ’22
Do Verification code generated using otpauth url in iPhone device password app gets autofill in app UITextField ?
I am working on a small PoC on iCloud Key Chain Secure Login with Verification code after going through this video. WWDC 2021 video, Secure Login with iCloud KeyChain I am using my github account credentials to generate 2 facor authentication : Otpauth url which I am using is : "apple-otpauth://totp/Github:MyGithubUserName?"+"secret=IssuerSecretKey&digits=6&period=30&issuer=github.com" Steps which I am following : Deleted 2 factor from my GitHub account on browser and deleted google authenticator app fro, iphone device. Added my GitHub credentials in device settings - password app In demo project, I have added one textfield and one button, textfield content type is .oneTimeCode and keyboard type as number pad. Added above mentioned hardcoded GitHub otpauth url on button tap which navigates to password app and generate verification code. Issue which I am facing is, Verification code is generated in device >> settings >> password section, but that verification code is not automatically get pasted in app textfield. Quickbar is not enabled for the Textfield for verification code. My UITextfield code is : securityCodeTextField.textContentType = .oneTimeCode securityCodeTextField.autocorrectionType = .no If I change textField to .userName then userName gets automatically filled in UITextfield. Kindly help me what I am missing.
Replies
0
Boosts
0
Views
761
Activity
Dec ’21
How to differentiate between SMS OTP and Timed-OTP on a web page
To secure a login page, we want to ask users for either an OTP code sent via SMS to their registered cell phone or a Timed-OTP validation code paired with their account. On the form, we would tag the input field for the SMS OTP with "autocomplete=one-time-code" and it should be filled with the token received via SMS. The other input field for the Timed-OTP code would also need to be tagged with the same attribute (according to the newly introduced method to embed TOTP inside of the KeyChain). Now if the user clicks in any of those fields, the SMS OTP value or TOTP value is available as a selection, leading to a confusion which to enter where. Normally, the user would only have one method chosen, so only one field would appear, however, this is not enforced. Is it somehow possible to only show the SMS codes in one field and the Timed-OTP codes in the other?
Replies
0
Boosts
0
Views
739
Activity
Oct ’21
ssl revoked after last Monterey update
I have a certificate from „eBlocker“ on my two mac systems ( both now at macOS 12.0 Monterey (21A5284e) ). I have set, as per instructions from eBlocker, the „Secure Sockets Layer (SSL)“ to „immer vertrauen“ (always trust). I updated my MacBook overnight and the next day eBlocker would not work anymore. So I finally checked the certificate, and it was reset to default. Strange, but who knows why it happened. So before running the update on my iMAC, I checked on the certificate there. It was set correctly. So I started the update and immediately after it was installed, I checked on the certificate, it was reset to default. I actually made screenshots, but all they show, is the reset SSL. The people at eBloker are not taking me seriously, but believe, that this just can not be. I would not think so either, but it did happen. And twice at that! I sure hope you have an idea, how this could be happening. I did use the Feedback-Assistent to let APPLE know. Thought this might get me a faster answer. Thanks in advance from Mannheim, Germany. Sorry, could not "find" a fitting tag.
Replies
2
Boosts
0
Views
1.3k
Activity
Aug ’21
Restore in apple
I formatted the phone and I did not have a backup in icloud Can apple restore the files that were on the phone before the phone was formatted??
Replies
1
Boosts
0
Views
807
Activity
Aug ’21
Does TOTP autofill actually work in iOS 15 beta 2?
I tried following the setup described in the WWDC21-10105 video, but the autofill suggestion does not appear above the keyboard as shown at 6:17 in video. With the same account, password autofill works. I was able to create a setup button to add a TOTP entry to the account. It bounces me to the Password area of Settings, and I can associate the TOTP with my account. But the verification code auto-suggestion does not appear in my app despite adding the UITextContentType.oneTimeCode attribute to my UITextField. Btw, I was hoping that the setup experience would happen in-app instead of getting bounced to Settings. I'm noticing also that the video has a text input keyboard, instead of numeric, which is odd because the TOTP input is actually restricted to 6 or 8 digits anyway.
Replies
1
Boosts
0
Views
1.7k
Activity
Jul ’21