0

I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone calls:

  • password + SMS (two places where shown) OR password + voice call (only received by your phone)

Both of which are visible in the case of theft of your phone. Compare this method to using a password + phone app generated one-time code in Android system. I cannot evaluate the security of the application for generating one-time passcodes in the Android phone. Access to it depends on having your passcode to your phone. Intuition suggests that it might be stronger than SMS/voice call. But what about possible vulnerabilities in the app.

How can you evaluate the security of these two methods? Why a well-designed app in Android is more secure than SMS/voice call?

Improve this question
2
  • Note: I've edited the OP's original question a little bit to make the English a little bit more understandable and sharpen the focus a bit. However, couldn't tell whether the OP wanted to specifically focus on scenarios where voice calls/messages were unavailable or not. Rather than substitute my own guess for what the questioner intended on the point I left that ambiguous as-is.
    – mostlyinformed
    Nov 18, 2015 at 5:19
  • @halfinformed I want the focus on why the well-designed app on your phone is more secure than SMS/voice call.
    – Léo Léopold Hertz 준영
    Nov 18, 2015 at 11:26

2 Answers 2

Reset to default
1

A well-designed app on your phone is more secure.

There are a large set of vulnerabilities in the delivery of either phone calls or text messages. They include messing with telephone routing tables, and systems such as which can collect text messages and route them as email.

If your phone is running an app, then these delivery and routing issues don't matter. If it's insecure, either because it's stolen or taken over by an attacker, then you're out of luck in either scenario.

Improve this answer
1

As an extension to Adam's answer, it's worth pointing out where the vulnerabilities lie.

Aside from the issues with intercepting messages en-route (I don't know a massive amount about the internal phone routing systems, or how easy it would be to manipulate them), the big difference is that SMS/Calls are typically pushed to the device, and tend to bypass a lot of access restrictions (most SMS messages show as notifications on a lock screen, and I don't know of many phones which require the passcode to answer).

However, an app would be a pull system, the individual would need to access the phones OS, open the app, and request the code. That means that the security features of the phone bolster the security of the product.

Consider the scenario that an employee's phone is stolen (not beyond the realm of possibility), and that the perpetrator is able to know/guess/deduce the employee's password. Once that check is made, the phone call is made/SMS is sent and easily accessed without touching the phone's access controls (or by transferring the SIM, if that is what's needed). However, the same perpetrator would be unable to access the app, and would not be able to log in.

There is an extension of this same issue related to simultaneity. If you're using a code generated by an app, this may be entered at the same time as the username and password, meaning that all 3 would need to be correct, and no hint as to the incorrect field could be given if a match was not found.

Because calls and SMS are pushed, the username and password would need to be verified prior to the second factor authentication, giving an attacker the knowledge that their credentials have been guessed correctly.

Improve this answer
2
  • "However, the same perpetrator would be unable to access the app, and would not be able to log in." Does this assume the secret cryptographic seed for the auth app is stored in some sort-of TPM-like area? (I think ARM uses what, something called Trustzone? About which I admit I know next to nothing.) If it were just, say, encrypted by a standard-length PIN it would be trivial for an attacker who could gain full access to the phone storage (in person or remotely) to recover the secret. Or am I missing something?
    – mostlyinformed
    Nov 19, 2015 at 3:01
  • That's true, but depends largely on the design of the app and the phone. My examples were centered around device access, rather than the security of the data on the device. I would probably argue that this is still more secure than the SMS/Call option, but there's not a massive amount in it.
    – Jozef Woods
    Nov 19, 2015 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .