Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app.
For example
- Gmail requires TOTP in Google Authenticator (usually co-located on the same phone)
- Yahoo sends an SMS message (to the same phone)
- Coinbase uses Authy uses an app (usually co-located on the same phone)
- Microsoft Azure/O365 (similar to Authy) uses an app (usually co-located on the same phone)
Any compromise of the phone, or more specifically inter process communications between apps, could allow a rogue entity to gain access to my protected data.
Question
- What approach is generally more secure? (app, vs SMS, etc)
- Is it a risk that PhoneFactor (Azure, 0365) has an in-app approval button that permits access, or is that a fair trade off between ease of use and security?
- Can someone explain the risk an OTP style app (listed above) getting the secrets compromised?
I assume that the risk is greater for Jailbroken iPhones and Rooted Androids.