Sending # & * in tel: URIs in iOS 5+

Question

Just recently we've noticed that calling [[UIApplication sharedApplication] openURL:url] with a tel: URI containing # or * characters is now permitted to be dialed in iOS 5.1.

e.g. NSURL *url = [NSURL URLWithString:@"tel:15555551212,,1234#"];

The documentation doesn't appear to have been updated to indicate that this is now allowed. It still doesn't work in iOS 4.x. We're testing to see when this changed. Does anyone know if Apple has officially changed its policy on dialing these characters from an app?

Answer 1

The change appears to allow # and * after , or ;, i.e. sending DTMF after the call connects. , waits a few seconds, ; lets the user decide when to send it with e.g. a "Dial 123" button. Presumably sending DTMF over the call is considered safe, given that it won't be interpreted as a service/USSD/etc code.

There's still the possibility of using it for nefarious purposes depending on operator, but this relies on the user not ending the call before it finishes the payload (e.g. you could delete some voicemail if you knew the right number).