According to news released by AndroidAuthority, after in-depth digging into the Android14QPR3Beta1 code, developers discovered the security feature of OTP (time-based one-time password) being developed by Google, which is expected to be launched in Android15.
The six-digit number generated by OTP or TOTP is usually used as 2FA verification. When 2FA verification is turned on, hackers cannot log in to the account even if the user's account password has been leaked.
But what if hackers carried out targeted attacks? For example, if the user's account password has been stolen and the user's Android device is invaded through some methods, the OTP verification code can be stolen.
So what Google is developing is actually a specialized API. Developers can use this API to declare that certain notification information is sensitive, and then the notification content is prohibited from being read by third-party unrelated applications to avoid leaking sensitive data.
Currently, developers have found that this API has two functions. The first is that the specific OTP verification code information will not be displayed in the notification when the screen is locked; the second is that untrusted applications cannot read notifications with OTP verification codes.
Google is developing this feature in Android 14 but has not enabled it. Therefore, Google is likely to prepare to enable this feature in Android 15 to improve security in some scenarios.