0

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login.

To me this seems like just another point of failure for a social engineer to take advantage of. We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication.

Also, Is what I am describing two factor authentication still? Or is it something entirely different?

I am asking because my client is begging me to implement this strange authentication standard.

Any Links to the studies on this subject would be extremely useful. Thanks.

To clarify, every time you login these steps will be taken.

  1. Enter Email.
  2. Enter Password.
  3. Enter Registered Phone Number.
  4. Verify Phone Number. If you can't, the system logs you out.
Improve this question
  • Verify phone number by text message received to it? – Potaito Jul 11 '16 at 21:01
  • @potAito, simply put, yes. – Ryuzaki Jul 11 '16 at 21:03
  • 1
    So it just treats the phone number as yet another secret, additional to the password. The only thing I can think of is a "too talkative" implementation. Meaning, that the site should never tell the user what's wrong. If the email is correct but the phone number wrong, it should not say something like "The entered phone number does not match the email address". Same for password and email of course. Otherwise an attacker could retrieve phone numbers associated to email addresses via brute force. – Potaito Jul 11 '16 at 21:05
1

Yes, this is two factor authentication, and it adds significant security.

To me this seems like just another point of failure for a social engineer to take advantage of.

This is not adding another weak point. It is adding another layer of protection.

We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication before.

It is not 100% perfect. Nothing is. But it is a big improvement over just using a single factor.

There are almost daily report of huge data breaches with passwords in plaintext all over pastebin. Attackers write scripts to automatically test these credentials against different services to steal valuable information. Do you think they will go through the trouble of attacking your site, when they will have to make a phone call to transfer a phone number they might not even have for every single account they want to breach? No.

I also suspect that in many countries, phone companis who just transfer a number like that without any verification could be held legally responsible. Again, just because a system has been broken under some circumstances does not mean it is completely useless.

Also, Is what I am describing two factor authentication still? Or is it something entirely different?

Unless I am missing something, this is plain old 2FA. The password is something you know, the phone is something you have.

To clarify, every time you login these steps will be taken. [...]

Some points here:

  • Make sure it is not possible to get the system to tell what phone number a user account is connected to.
  • Why do you have to reenter the phone number? That should already be stored in the database, right? (I am asuming each account is connected to a phone number, otherwise this is sort of pointless.)
  • You say that if you can't verify the phone number, the system logs you out. I would say that you should not be allowed to log in until you have verified the phone number.
Improve this answer
0

If verifying the phone number is through receiving a code by SMS, then "Yes", that is two factor authentication:

  1. Something you know: email and password
  2. Something you have: verified phone

This is generally considered much more secure than either factor on its own. In fact the 2016 Verizon Data Breach Investigations Report mentions that “63 percent of confirmed data breaches involved weak, default or stolen passwords.”

References:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.