proomt

Search

Search posts, papers, and topics

All posts

CodeName OneShai Almog3 min readintermediate

Fill an SMS Verification Code Without Reading the Inbox

Read on codenameone.com

Summary

Codename One adds a one‑time‑code autofill component that leverages iOS, Android, and browser autofill APIs, eliminating the need for SMS‑reading permissions. The new `PhoneVerification` component handles phone entry, code entry, resend timing, and server callbacks, while the UI uses a single hidden editor to back six visual boxes, improving typing, paste, and accessibility. The post explains the…

  • Use `TextArea.ONE_TIME_CODE` (or equivalent) to get OS‑provided OTP autofill without SMS permissions.
  • The `PhoneVerification` component separates UI state from network logic via async callbacks.
  • Internally, a single hidden editor now owns the full OTP value; visual boxes are just presentation.
  • Design emphasizes minimal permissions: no inbox access, no background SMS parsers, aligning with secure‑by‑default principles.

Reducing permission surface improves user privacy and app review compliance, while OS autofill offers a smoother UX. The component’s architecture also demonstrates a clean separation of concerns for verification flows in cross‑platform mobile apps.

6/10
securityfrontendmobilecross platformotpautofill

Related reading

  1. VoIP, VPN, and the Build System Behind Them

    Codename One’s new builder pipeline can automatically generate the native plumbing required for VoIP call integration, managed VPN profiles, and packet‑tunnel extensions on iOS and Android. By inspecting which Java packages an app imports, the builder adds the necessary frameworks, entitlements, services, and even a separate signed Network Extension for iOS, letting developers keep their signalin…

    CodeName Onecodenameone.com10 min

  2. We Stopped Waiting for Platform Changes to Find Us

    Codename One added a daily automated scan of Apple and Google deprecation notices, linking each notice to concrete builder artifacts before work is created. The system caught the Android 16 back‑gesture change and enabled a permission‑free ContactPicker, turning policy shifts into repeatable, evidence‑backed patches.

    CodeName Onecodenameone.com3 min

  3. SQLite Across Every Port: One Contract, One Encrypted File Format

    Codename One now ships a single, tested SQLite contract that works natively on Android, iOS, Windows, Linux, and in browsers via WebAssembly, with built‑in SQLCipher‑4 encryption supporting three key models. A conformance suite guarantees identical behavior across platforms, and migration helpers let legacy apps opt‑in. The update also adds a proper watch‑app model, DOM‑based text for JavaScript,…

    CodeName Onecodenameone.com11 min

  4. Rootless Jailbreak Detection: Updating the Signals, Not the Claim

    The blog explains how Codename One updated its iOS jailbreak detector to handle modern rootless jailbreaks (e.g., palera1n, Dopamine). It replaces old file‑system probes with lstat checks, mount scans, and dual‑opinion API calls (libc vs raw syscall) to spot hidden bootstraps and instrumentation. It also reorders package‑manager URL‑scheme probes to prioritize Sileo, adds a background‑resume gate…

    CodeName Onecodenameone.com5 min

  5. Tapjacking Protection: Rejecting Android Touches Behind an Overlay

    Codename One adds tapjacking protection to its Android runtime. It detects fully or partially obscured MotionEvents, offers four policies (OFF, REPORT, BLOCK, STRICT), can block the entire gesture, and on Android 12+ can request the system hide overlay windows. The API is exposed via `DeviceIntegrity.setTapjackingProtection` and a listener for state changes. iOS has no overlay threat, so the feat…

    CodeName Onecodenameone.com3 min