4

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone).

The often cited reason for this is the rather non-specific: "to protect your account".


I agree that, in case the user is otherwise exclusively using desktop/laptop computers to interact with the service, using a phone as an out-of-band verification of 'something you have' could effectively been seen as two-factor authentication.

However... over 50% of all online access is now done using mobile devices, such as smartphones.

Does the use of a mobile device, to prove that the user has access to said device, undermine the implied added security?

Improve this question
3
  • 3
    Phone "verification" is often just an excuse to get the user's mobile number for tracking/analytics.
    – André Borie
    Apr 9, 2016 at 15:16
  • @AndréBorie, I know it is :-)
    – Jacco
    Apr 9, 2016 at 16:00
  • I always say use a split-key method where half of the symmetric passphrase (or key) goes through email (or web -- really any TCP/IP-based mechanism) and other over SMS
    – atdre
    Apr 9, 2016 at 17:37

2 Answers 2

Reset to default
2

Phone/SMS verification works, it just solves a different problem than loss of your phone.

Phone verification prevents against an attacker impersonating a user by logging in as them from some random network device using their username and password. For example, if a user's password is exposed because they reuse the same email and password on multiple sites, an attacker with that information won't be able to complete a login due to not having your phone. Even in the terrible situation of the site storing passwords insecurely and losing its password database to an attacker, phone verification will prevent unauthorized authentication.

Phone verification does not prevent against the physical loss of your phone or an attacker installing privileged software on your phone. For that, phone encryption with a strong password, locking your phone, only installing trusted software, etc... is required.

Edit: Interesting article about how losing control of PC can lead to 2FA bypass. Publication: How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication.

Improve this answer
1
  • In addition to that, it also makes it hard for people to create multiple accounts on the same website. Music sharing sites will normally offer a 30 day trial period for the website. The website will use the phone number rather than email address to track a user as users can simply create another account using a different email address. For people to do the same using phone numbers, they will have to get a new SIM card. This process is very tedious and takes time. So it sort of 'checks' the users from exploiting services like these.
    – Aswin P J
    Apr 9, 2016 at 17:59
1

I can think of 2 ways the phone-based verification helps, even if your mobile device is how you access sensitive web sites. Both require that only you have physical access to your device.

  1. If you use your phone to enter your credentials on a phony web site (for example due to a phishing attack) then when the attacker tries to use them to log into the real web site the phone-based verification will protect you.
  2. If your phone is infected with malware that steals login credentials but that malware is not smart enough to disable the phone-based verification then you should also be protected.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .