3

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app.

For example

  • Gmail requires TOTP in Google Authenticator (usually co-located on the same phone)
  • Yahoo sends an SMS message (to the same phone)
  • Coinbase uses Authy uses an app (usually co-located on the same phone)
  • Microsoft Azure/O365 (similar to Authy) uses an app (usually co-located on the same phone)

Any compromise of the phone, or more specifically inter process communications between apps, could allow a rogue entity to gain access to my protected data.

Question

  • What approach is generally more secure? (app, vs SMS, etc)
  • Is it a risk that PhoneFactor (Azure, 0365) has an in-app approval button that permits access, or is that a fair trade off between ease of use and security?
  • Can someone explain the risk an OTP style app (listed above) getting the secrets compromised?

I assume that the risk is greater for Jailbroken iPhones and Rooted Androids.

Improve this question
1
  • 1
    This is a big question. I will say that SMS relies on the security of the accounts at the carriers and they are not incented to do much security. For example, if they have a strong password policy, their helpdesk calls go up. Also, if sites are dropping password files left and right, do you really want them to have your phone number?
    – nowen
    Mar 9, 2015 at 23:36

1 Answer 1

Reset to default
1

SMS or app:

App-style access is more secure on both major platforms since app data is sandboxed while SMS provider is publicly accessible from all apps. Android is a little bit more secure than iOS since it gives the user a list of privileges an app is using hence giving out a clue to the user to be more cautious when the app asks for SMS access (or, if using CyanogenMod, it can be even shielded from SMS by Privacy Manager).

On the other hand if the device is compromised sandbox won't help you much unless the sandbox is encrypted. I believe that iOS does this but I'm not sure, you'd have to ask some iGeek that. A sandbox breach clears the difference between sms or other app since sms app is just another app. Some OTP apps encrypt their secrets using a PIN and some devices have some kind of TPM circuitry that might be leveraged.

OTP secret compromise:

If your OTP secrets are leaked, the OTP can no longer be considered secure. You should negotiate new secrets ASAP. It equals to your hardware OTP token being stolen.

Improve this answer
2
  • 1
    Apps do not have access to SMS on iOS, so it should actually be more secure than Android by default.
    – gerry3
    Mar 24, 2015 at 18:33
  • Thanks, I didn't know that this API si private. Will edit the answer appropriately.
    – jficz
    Mar 24, 2015 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .