Just this week I’ve heard people on two different podcasts talking about how in macOS Tahoe, AutoFill of verification codes received in Messages or Mail work in more Mac apps than before, including popular web browsers.

[palombo@mastodon.social]

@rmondello Tell me more about those unspeakable things...

[jasonkarns@indieweb.social]

@rmondello love it!

I do think I’ve encountered an edge case but having trouble getting it accepted as a bug with support, though.

Is there another avenue I could share more details? The tldr is that the bug is specific to when an sms 2fa code is sent to Google voice, then forwarded as email to Mail app. I strongly suspect the bug is with the Mail parsing.

[bobdel@mastodon.social]

@rmondello you rock!

[danwing@infosec.exchange]

@rmondello I’m glad it’s there and works so well. It’s a big part of the Apple experience now.

But I do wish we didn’t have so many SMS- and email-based MFA. It’s more to fail especially traveling internationally, mobile operators transferring phone numbers to attackers, and all the other stuff you well know. Fortunately you’re also improving password management! (And please passkeys)

[marcoarment@mastodon.social]

@rmondello Thank you. It’s incredibly nice to have!

Think of the cumulative worldwide time saved. I can’t even fathom it.

(Next I’ll ask for a way to use passkeys for Apple IDs that aren’t the same one as my logged-in user account, so I can log into developer.apple.com, App Store Connect, etc. with my developer account. )

[jarhill0@hachyderm.io]

@rmondello I have noticed this in Firefox over the last few months! Thank you!

[nicolas17@social.treehouse.systems]

@jasonkarns I think you should report it on https://feedbackassistant.apple.com, then tell @rmondello the ticket number

[command_tab@hachyderm.io]

@rmondello As someone who signs into things A LOT, thank you

[harpaa01@mastodon.social]

@rmondello it is hands-down my biggest motivator to get all my machines on Tahoe

[andreasschenk@techhub.social]

@rmondello while I love it really for all the nice and useful workflows, some of my users report it to be getting in their way when it is coming up to fill in on not useful targets - like you have a spreadsheet open and get the autofill code into the spreadsheet cell…
Is there a way to control acceptable targets?

[andreasschenk@techhub.social]

@marcoarment @rmondello that would be a blast!

[rachel@norfolk.social]

@rmondello @popularposts the one missing place I find really odd is the popup dialog to sign in to public WiFi. Can’t use stored passwords there and I’ve never understood why - works on iOS but not Mac OS.

[david_chisnall@infosec.exchange]

@rmondello

This is one of the features that makes me nervous about the Apple ecosystem. The point of sending a second factor code to another device is so that you need to compromise two devices to log in as the user. If the second channel automatically forwards to the first, doesn’t that completely undermine the security?

This flow would make me much happier if i had to press a button on the phone to send the codes and have them autofill on the other device.

[covercash@mastodon.social]

@rmondello

[jon889@mastodon.social]

@rmondello does a code field appearing trigger Mail to refresh the inboxes? I always find I have to open Mail and refresh for it to work. (iCloud email). Whereas SMS works beautifully ️