To secure a login page, we want to ask users for either an OTP code sent via SMS to their registered cell phone or a Timed-OTP validation code paired with their account. On the form, we would tag the input field for the SMS OTP with "autocomplete=one-time-code" and it should be filled with the token received via SMS. The other input field for the Timed-OTP code would also need to be tagged with the same attribute (according to the newly introduced method to embed TOTP inside of the KeyChain). Now if the user clicks in any of those fields, the SMS OTP value or TOTP value is available as a selection, leading to a confusion which to enter where. Normally, the user would only have one method chosen, so only one field would appear, however, this is not enforced. Is it somehow possible to only show the SMS codes in one field and the Timed-OTP codes in the other?

I am going to add safari extension in my app. I need biometric authentication for validate user. when I evaluate device owner authentication via Local Authentication then an error found. [Error Domain=com.apple.LocalAuthentication Code=-1004 "Caller is not running foreground." UserInfo={NSDebugDescription=Caller is not running foreground., NSLocalizedDescription=User interaction required.}] My Question is how may I force to safari extension to be in foreground to fix this issue? Or let me know if I can use any other way. Code: -(void)doBioMatricAuth{     context = [LAContext new];     context.localizedCancelTitle = @"Enter Username/Password";     if([context canEvaluatePolicy:LAPolicyDeviceOwnerAuthentication error:nil]){         dispatch_async(dispatch_get_main_queue(), ^{             NSString *reason = @"Log in to your account";             [self->context evaluatePolicy:LAPolicyDeviceOwnerAuthentication localizedReason:reason reply:^(BOOL success, NSError * _Nullable error) {                 if(success) {                     NSLog(@"Biomatric success");                                      } else {                     NSLog(@"Biomatric Failed %@",error.localizedDescription);                 }             }];         });     } }

This is a massive clause change and it doesn't seem like enough people are discussing this as the update to the the anti-steering clause is the "hotter" topic (with everyone forgetting that its no longer of any benefit to them if users don't give you their email addresses anyway). "Apps may request basic contact information (such as name and email address) so long as the request is optional for the user, features and services are not conditional on providing the information, and it complies with all other provisions of these guidelines, including limitations on collecting information from kids.” Ok. So now, if my app has account based features, they would need to register. If they register, if we don't use a phone number or email address, we would have to use a unique identifier. So ok, let's use a unique identifier. Now, that user forgets their password. Well, good luck to you, you didn't give us your email or number, so we can't verify that it was you who created the account. Like how Reddit does it. Ecommerce? How can I deliver to customers (the service) if I don't get their address (contact information)? There is 0 way to satisfy that clause in this situation. In fact, even to pay for the item with a Credit Card, they would have to enter their Billing Address. How do I send customers receipts of their purchases without their email address? (and don't tell me you can just show it in the app... try sharing that with an accountant) How do I enable 2-factor authentication without SMS or Email? Covid Tracing / Check In apps - are they exempted? Literally cannot use any other email client other than Mail (Email Address) Or sell a house (Address). Is there any way to get clarity on these questions from Apple? 1 - If we offer Sign in with Apple alongside Plain Old User Email Authentication, does that satisfy Clause 5.1.1(x) - because Signing in with Apple email addresses are 'opt-in' using the Hide my Email feature", ? 2 - How does the clause support applications where the provision of a service is functionally dependent on contact details, as mentioned in Clause 5.5.1(v) "Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law."? 3 - How does this clause satisfy other use cases that may require Proof of Identity (using Identity Verification Services) such as Government (as mentioned in Clause 4.8 "Your app uses a government or industry-backed citizen identification system or electronic ID to authenticate users.")

The Sample Mail App Extension project no longer builds under Xcode 13.1 due to conflicting swift and obj-c protocol method signatures

Hello I've just installed the 15.2 beta developer beta and had a look at the new App Privacy Report feature. I can see the domains being contacted by my app coming through as expected. However, there is also a message there that I don't understand: "This app hasn't been updated by the developer to show which domains were contacted by websites or other content viewed in the app." Does anyone know what this is referring to? I'd like to update the app to support this, but I don't really understand this message or what action is expected. Thanks Updated to add: I have tested visiting a website in the in-app browser and it does appear in the Privacy Report in a separate section titled "Websites Visited In App". The above message is still present, however.

Dear Apple , I discovered a bug about iPhones and even made a video of it and uploaded it to the following address: https://feedbackassistant.apple.com/feedback/9184844 In the last few days, he has not received any response from any of Apple's backers Apple app development consultants also listed the site address in my replies: https://www.apple.com/feedback/iphone.html I'm on this site and I wrote everything about the bug I discovered, but I still did not get a response from the Apple team Please select this important topic and announce my answer My goal is to work with the Apple team to fix the iPhone fingerprint bug Please be sure to check my feedback on this bug along with the video I made myself My Feedback Address: https://feedbackassistant.apple.com/feedback/9184844 Regards , Hamed Hamedi

OAEP (i.e. Optimal Asymmetric Encryption Padding) as defined in RFC 2437 is parameterized by the choice of hash function and mask generation function. The hash function is usually either SHA-1 or SHA-2 while the only mask generation function defined is MGF1 which itself is based on a hash function. In the Security.framework this padding scheme is available as OAEP (deprecated as of iOS 15) and as properties of the SecKeyAlgorithm structure, e.g. rsaEncryptionOAEPSHA1. The documentation for both only reads No overview available but from the comments in SecKey.h can be gleaned that at least for rsaEncryptionOAEPSHA1 data is padded using OAEP padding scheme internally using SHA1. So it seems that while using SecKeyAlgorithm the choice of hash function corresponds to selecting a property of the structure; the question that remains is whether this hash function is used for both the encoding scheme and the mask generation function. I suppose that this is in fact the case, but I am unable to find anything corroborating this.

I'm developing an authorization plugin to provide 2 Factor Authentication (2FA) for macOS. When FileVault is enabled, macOS Recovery prompts the user for a password to unlock FileVault FDE (Full Disk Encryption) before macOS can startup. The FDE password entered during Recovery is saved somehow so that after macOS starts up it can be used to log the user in without prompting them to re-enter their password. This feature is configurable with setting 'DisableFDEAutoLogin'. We would like our authorization plugin to implement the same behavior. The first place I thought to look for the FDE password (from within our authorization mechanism) is in Context value kAuthorizationEnvironmentPassword but it's not there. Is it possible for an authorization plugin to obtain this password the same as the standard login mechanism and if so how?

According to recent update of apple review guideline starting from January 31, 2022: all apps that allow for account creation must also allow users to initiate deletion of their account from within the app Our app currently allow to initiate the deletion process within an app, although user is redirected to the web page, where she needs to confirm it in order to make it happen. The web part of process is conducted in the SFSafariViewController, which is still a part of the app, so here is the question, is this enough to meet review guidelines criteria?

From a security perspective: now that screenshots get LiveText selection and copy, how do we prevent people from taking screenshots of our application screens that contain potentially protected information? I know it's possible to block screenshots device-wide since MDM provides that control, but how can we block screenshots of our application - or is there a way to determine when a screenshot is being taken and block just that content from the screenshot?

Hi, I would need to encode my data in ASN.1 Looking at the API, it is marked as deprecated, the API reference has been removed. Is there any alternative? Thanks

Apps like Password Managers and such claim to encrypt your sensitive data, and only transmit and store your data on their servers in encrypted form, never in plain text. But how are we supposed to believe that? Just take their word for it? Who's to say that their developers won't accidentally (or intentionally!) make a mistake in their code at some point and get to see your sensitive data? I am asking because I am currently writing an app using the Swift-Crypto package to do AES encryption. I save the user's data in encrypted form in Core Data on the device as well as mirror it on their iCloud account using CloudKit. When I submit the app to Apple for review, without looking at the source code, will they be able to verify 100% that my app actually and correctly encrypts all the data so that users can confidently trust that their data will be safe? How can we be sure?

I'm the IMAP maintainer for Mozilla Thunderbird. I've been looking into adding QRESYNC imap extension to Thunderbird which currently only supports CONDSTORE extension. The icloud server returns these in its capabilities response: CONDSTORE ENABLE QRESYNC indicating complete support for enabling CONDSTORE and QRESYNC. But when I try to enable them, I get no "ENABLED" untagged response as required by imap ENABLE rfc: Tbird sends: 33 ENABLE CONDSTORE QRESYNC UTF8=ACCEPT icloud sends: 33 OK ENABLE completed The correct imap ENABLED response is like this: Tbird sends: 33 ENABLE CONDSTORE QRESYNC UTF8=ACCEPT icloud sends: * ENABLED CONDSTORE QRESYNC icloud sends: 33 OK ENABLE completed Since icloud doesn't support the UTF8=ACCEPT imap extension, it should just be excluded from the untagged ENABLED response. Several other imap servers I've tested (Dovecot, Cyrus and Zimbra) respond correctly when Thunderbird attempts the ENABLE but icloud responds in a non-standard manner. There are other problems too with the icloud response to imap SELECT with the QRESYNC parameter in that it produces an imap FETCH response for all messages in the folder with a sequence number of minus 1 (sequence numbers are supposed to be positive, 1 to number of messages in folder, never negative). Note: This seems to require a tag. Couldn't find one relevant to my question so just picked one with "icloud" in name.

As I read the apple documentation on secure enclave and key chain, extraction of private key is not allowed. following is the reference: "Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security." Link: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave But after loading the key using "SecItemCopyMatching" and then passing the object into "SecKeyCopyAttributes" gives us a dictionary of key value pairs. I believe that the private key was part of the value for key "toid" of that dictionary. is my understanding correct or, am I missing something? I couldn't find the documentation describing the meaning of the key value pairs of the dictionary returned by "SecKeyCopyAttributes". I'll appreciate if somebody can guide me to that documentation. Note: I am creating EC key pair.

On BigSur custom settings for the root CA store were saved under /Library/Security/trust settings/Admin.plist On Monterey this has changed but I could not yet find the new location. Also is there an easy way to change trust settings? When you change trust settings for many root CAs you need to click through them manually, provide password each time ... Is there some way to easily override the system root CA store? I know you can't change the file itself without disabling SIP. But some way to import a custom CA store while the original one will then be ignored?

I was wondering what information Siri collects from participating apps, how it uses that information, and if there are specific APIs that apps use to contribute information to Siri.

Hi everyone, I am very new to SwiftUi and am not sure about data collection to disclose. Does using the sign in with Apple feature and Core Data with CloudKit count as Data Collection? (if it does what would it come under) I use @AppStorage for the sign in and not the UserDeafult feature. For CloudKit I only use the inbuilt NSPersistentCloudKitContainer container and for saving the generic:  viewContext.automaticallyMergesChangesFromParent = true viewContext.mergePolicy = NSMergeByPropertyObjectTrumpMergePolicy Thank you

I setup Password AutoFill in my iOS 14 app. The app uses multiple tabs. Associated Domains are also set up. All works as expected. I have a Test button below the user/password TextFields, which the user can press to test just entered credentials. Now, the Save Password dialog shows only when I change to another tab. Is there any possibility to programmatically force the Save Password dialog to appear on the same tab where the user/password TextFields are located? I would like to present it to the user right after the Test button is pressed and credentials are verified to be correct.

Hello, Our app requires When in Use Authorisation to work. Is it a good head to use CLLocationButton to ask for this Authorisation for iOS 15 users? We tried using this button but it only shows only two options OK and Not Now as shown in this pic. Is it possible to show When in Use Authorisation here?

Whenever user tries to login with biometric and it failed multiple times then the passcode screen appears and this is the screen which we don't want for our perfectly secure applications. We are looking to authenticate user with biometric only and not fallback to passcode which is same as the Apple internal API https://developer.apple.com/documentation/security/secaccesscontrolcreateflags where we can enforce user to use biometric based login. Although we like WebAuth framework but this is the only reason we cannot move forward with the WebAuthn framework. is it something Apple can think about providing to make application more secure ?