I currently want to start web development where I will be making a login system and want an alternative to storing passwords.

The question is: is it safe to use the Google Authenticator app as the main login along with SMS authentication as a second authentication type? If not is it safe to use Google authentication and SMS authentication as the main way to login?

  • 1
    "Safe" is like "pretty" - without an objective yardstick, it is just a personal opinion. On the other hand, nearly anything is more secure than passwords.
    – MCW
    Jan 6, 2016 at 19:25
  • Authenticator yes. SMS no - it's not secure. See zdnet.com/article/…
    – Stone True
    Aug 18, 2017 at 14:23

2 Answers 2


When it comes to security, there are the three main paradigms:

  1. Something you have can be interpreted as either an RFID key-fob, the Google Authenticator, a RSA key, etc. Any physical object or thing that you need to posses to authenticate.

  2. Something you know is most commonly interpreted as a password, but could also be a sequence of colors or shapes. Something that you have to memorize.

  3. Something of you. This is bio-metrics: your voice print, your finger print, a scan of your retina, a 3D topological scan of your hand, how you walk, your DNA.

The current industry standard for authentication is moving towards a two-factor system as a baseline. This just means that you require two of the three authentication paradigms.

You using Google or Facebook authentication as one of your two-factor systems, fulfills the something you know part of the equation, as the user has to know their login information for Google or Facebook.

Sending a user a text message fulfills the something you have part of two-factor.

Implementing both of those into your authentication scheme will put you about a year or two ahead of a large part of the application industry. Your only real issue will be in how you secure the hashes you receive from Google/Facebook, on the user's account creation and the phone numbers associated with the users.

If your table with the Google/Facebook hashes or the user phone numbers gets compromised, then it is basically the same as your user giving away their passwords.

  • 1
    How is leaking a phone number the same as leaking a password? Jan 6, 2016 at 22:08
  • The you say Google/Facebook authentication do you mean login in with the Google/Facebook account? I meant the Google authenticator app which gives you a code.
    – iProgram
    Jan 7, 2016 at 8:58
  • As you are basically using the phone number as identification. If an attacker knows the phone number, then you just man in the middle the connection, as text messages are not encrypted. Jan 7, 2016 at 14:31
  • MiTMing an SMS connection is a much more complex to achieve than using a stolen password. Jan 7, 2016 at 16:45
  • 1
    Yes, I read this answer as logging in with a Google/Facebook account, or an OpenID sort of thing. If that's not what you meant, then you only use two "something you have" factors, so it's really not 2-factor anymore, and therefore not really very secure. What if somebody steals your phone? I'm guessing most people will use the same phone for the authenticator app as they get their SMS on.
    – Ben
    Jan 7, 2016 at 16:53

You should NOT rely on only "something you have" for login. In some ways this is arguably LESS secure than a password (assuming a strong password is used), because a phone is easily lost or stolen; although it is admittedly less susceptible to large attacks trying to get a big percentage of your users without targeting any of them specifically.

If you don't want to bother asking for passwords and storing their hashes yourself, or you just don't want to deal with the hard problems involved in authentication, then look into OpenID or Facebook Connect or a similar service that lets you ask a trusted third party (e.g. Google) to authenticate the user for you instead of doing it yourself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .