texting password reset link instead of a code

Question

An increasingly common process for assisting with password resets is the application texting a code/token to the user’s verified mobile phone.

We have a client which would like to eliminate the need for the user to remember the code and instead send a bitly link via SMS where the code/token is embedded in the bitly link. This way the user can just touch the link in the SMS message, which will launch their mobile browser and they can proceed with the password reset, possibly with an additional verification with security question or other PII data point.

Is there a reason the above process isn’t being used by the likes of Facebook and Google and instead they continue to just send the code via SMS? It seems, at least on the surface, to just add an unnecessary step of memorization for the end-user to transfer the code from SMS to mobile browser.

Answer 1

I can think of a couple of flaws with that plan:

• It doesn't work for users who are using a different device to perform the password reset for some reason, such as not using a smartphone. For Facebook and Google, it's not uncommon for users to change their passwords using a computer, but to receive a validation code by mobile.
• Potentially increases the risk of phishing attacks, by encouraging users to follow shortened URLs claiming to be from a service provider. The use of bitly adds to this, since it's not easy to see the URL which the link actually goes to.

For a mobile application, it's a flawed premise to begin with though, since SMS is not a second factor in this case (an attacker with the phone has access to the SMS message!). Some providers take this into account, and require that password changes are performed through the website, even when they have an application, in an effort to ensure that the existing password is known to the person attempting to change the password (requiring that it is entered for password changes would also work, of course).