Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?

Is it secure? I think it is not a good practice to rely authentication only on such codes which come on mobile phone, because someone can just steal your mobile phone and that's it.

I think better alternative would be to combine the above mechanism with a username/password authentication. What is your opinion? What are the best practices in such direction?

share|improve this question

marked as duplicate by Terry Chia, Lucas Kauffman, NULLZ, Noordung, Xander Aug 2 '13 at 13:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
I think it fully depends on the use case, the threat model and attack scenarios. It apparently has enough security for many promotions where you get a unique number hidden with a product. Is it enough for online money transactions? Probably not. –  Maarten Bodewes - owlstead Aug 2 '13 at 10:58
    
This is called two-factor authentication, many services (incl google, facebook, etc) use this today. –  JimL Aug 2 '13 at 10:59
    
@JimL if you regard the phone to be something you have then it is two factor authentication - but the line between one-factor and two-factor are a bit blurred here; if I retrieve the one time password (e.g. by listening in on the GSM network) then it becomes something you know - leaving only a single factor... –  Maarten Bodewes - owlstead Aug 2 '13 at 11:02
    
I think the way it is now, it is one factor authentication - because if someone steals your phone, he can authenticate as I mentioned using the code he receives on SMS ... –  user2568508 Aug 2 '13 at 11:15
    
@owlstead in practice a combination of password+text message is often used by banks for micro transactions up to about 250 USD. –  Lucas Kauffman Aug 2 '13 at 11:18

2 Answers 2

I'd say just a code on the phone is weaker than username and password (because you can loose a phone and someone might abuse it). Combining them is a form of multi-factor authentication:

  • something you know (password and username)
  • something you have (phone with text message)

and depending on the level of authentication you need, this is considered a good and strong form of authentication.

share|improve this answer

Out of band One Time Passcode designs like this are typically called multiple single factors and are quite common, especially where privilege escalation is required when the user is already logged on, e.g. making a transaction.

Mobile phones are just always-connected small computers nowadays and thus aren't a second factor - so I don't consider any of the following authentication methods as "second factor":

  • bluetooth auth (is supported by some unlock screen saver functionality)
  • SMS one time passcode
  • NFC (used for micro financial transactions)

Multiple Single Factor can be stronger than single factor, although take care because asking a user for 2 text passwords isn't much stronger than a single factor password request.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.