0

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login.

To me this seems like just another point of failure for a social engineer to take advantage of. We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication.

Also, Is what I am describing two factor authentication still? Or is it something entirely different?

I am asking because my client is begging me to implement this strange authentication standard.

Any Links to the studies on this subject would be extremely useful. Thanks.


To clarify, every time you login these steps will be taken.

  1. Enter Email.
  2. Enter Password.
  3. Enter Registered Phone Number.
  4. Verify Phone Number. If you can't, the system logs you out.
3
  • Verify phone number by text message received to it?
    – Potaito
    Commented Jul 11, 2016 at 21:01
  • @potAito, simply put, yes.
    – Ryuzaki
    Commented Jul 11, 2016 at 21:03
  • 1
    So it just treats the phone number as yet another secret, additional to the password. The only thing I can think of is a "too talkative" implementation. Meaning, that the site should never tell the user what's wrong. If the email is correct but the phone number wrong, it should not say something like "The entered phone number does not match the email address". Same for password and email of course. Otherwise an attacker could retrieve phone numbers associated to email addresses via brute force.
    – Potaito
    Commented Jul 11, 2016 at 21:05

2 Answers 2

1

Yes, this is two factor authentication, and it adds significant security.

To me this seems like just another point of failure for a social engineer to take advantage of.

This is not adding another weak point. It is adding another layer of protection.

We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication before.

It is not 100% perfect. Nothing is. But it is a big improvement over just using a single factor.

There are almost daily report of huge data breaches with passwords in plaintext all over pastebin. Attackers write scripts to automatically test these credentials against different services to steal valuable information. Do you think they will go through the trouble of attacking your site, when they will have to make a phone call to transfer a phone number they might not even have for every single account they want to breach? No.

I also suspect that in many countries, phone companis who just transfer a number like that without any verification could be held legally responsible. Again, just because a system has been broken under some circumstances does not mean it is completely useless.

Also, Is what I am describing two factor authentication still? Or is it something entirely different?

Unless I am missing something, this is plain old 2FA. The password is something you know, the phone is something you have.

To clarify, every time you login these steps will be taken. [...]

Some points here:

  • Make sure it is not possible to get the system to tell what phone number a user account is connected to.
  • Why do you have to reenter the phone number? That should already be stored in the database, right? (I am asuming each account is connected to a phone number, otherwise this is sort of pointless.)
  • You say that if you can't verify the phone number, the system logs you out. I would say that you should not be allowed to log in until you have verified the phone number.
1
  • Having the user enter their phone number could be a vulnerability, though, because of potential phishing. If you make a copy of the login screen on your own server and send it in an email, they can now convince you to give up your email, password, and phone number, which significantly limits the security of the second factor, especially since we know that SMS isn't secure. Though I've never tried it (of course), it's reportedly pretty easy to intercept SMS messages to a known phone number. This is why most apps present your phone number in 2FA as, e.g. "***-***-1234." Commented Apr 3 at 17:32
0

If verifying the phone number is through receiving a code by SMS, then "Yes", that is two factor authentication:

  1. Something you know: email and password
  2. Something you have: verified phone

This is generally considered much more secure than either factor on its own. In fact the 2016 Verizon Data Breach Investigations Report mentions that “63 percent of confirmed data breaches involved weak, default or stolen passwords.”

References:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .