I've seen mobile apps use two-factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in conjunction with another medium (e.g. a website on a desktop) but if the phone itself is sent an OTP of sorts, what's the security advantage being offered?

In particular, I'm looking at Authy and wondering value it brings to a mobile app?

  • I think if the user gets his phone stolen, he logically won't use his web applications until he blocks/renews his phone number, so from this standpoint I do not think it is really a big issue.
    – user45139
    Oct 27 '15 at 16:55
  • @Begueradj - That assumes they've noticed the phone has been stolen at that point. But if a mobile app is using OTP sent via a text, how is that providing extra security? If I have a mobile phone and am logging into an app on that phone, an SMS OTP seems like an unnecessary extra step. I steal a phone with the phone number 123. The app asks me my number, I put 123. I get sent a OTP that I enter there and then as I have the phone in my hand. On the other hand, I may be misunderstanding what Authy and OTP (for mobile apps) works :)
    – Secoority
    Oct 27 '15 at 17:04
  • Yes, indeed, I agree with you: the scenario where the user did notice his phone is stolen it's useless
    – user45139
    Oct 27 '15 at 17:07

You are correct, this is not effective in the case of the device being stolen - you need good local authentication for that such as a long pin, password, passphrase, and potentially biometrics.

However these OTP solutions are not trying to address that threat. They are intended to prevent someone from attempting to access a service by guessing usernames and passwords, or using usernames and passwords stolen from elsewhere (e.g. through keyloggers, database dumps etc).

For example:

  1. XYZ website is hacked and the usernames and passwords cracked and published online
  2. I get the list and try each of the credentials against the ABC website
  3. Often users will have used the same usernames and passwords and I will gain access to some accounts
  4. However if my account on ABC website is linked to a mobile number and uses an SMS to authenticate then knowing my username and password doesn't allow you to compromise my ABC account unless you can also intercept the SMS
  • 1
    Thanks for your reply Andy. I understand the use case regarding the website/mobile combination but I'm struggling to understand why the Authy site says "Strengthen — even replace — the traditional username and password login for websites, SaaS products, and mobile apps." Websites and SaaS makes sense but I fail to see how mobile apps could take advantage in most use cases.
    – Secoority
    Oct 27 '15 at 17:39
  • A mobile app is usually just an alternative user interface to the same back - end services. It is protection of the server side aspects that is being improved.
    – Andy Boura
    Oct 27 '15 at 18:00
  • 1
    @Secority: ...even replace... This is all annoying marketing crap. You do not want to replace the password, since you then would replace one-factor-auth with knowledge (password) with one-factor-auth with possession. I recommend ignoring companies talking of "replacing", since they do not talk about security. As you already did you need to ask yourself, if the factors require different kind of attack vectors. Then you are increasing security. If you have two factors, that can be attacked with the same method, the two factors merge to one again.
    – cornelinux
    Oct 28 '15 at 15:20
  • @cornelinux - Thanks, glad I'm not missing something obvious here!
    – Secoority
    Oct 29 '15 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.