Is phone-based authentication more secure than passwords?

Question

Let's say I ask my user to provide email, first and last name, last 4 of ssn, date of birth, and a phone number. On login, I send a 4 digit pin as a text.

Considering users tend to reuse passwords and a lot of site's passwords are breached, doesn't it make more sense to use the phone (something that you have)?

The UX is great.

To clarify, if the password is something you know and the phone is something you have, why not use only one of the two. Use only something you have (phone)?

What are the drawbacks. People all over the world guess and steal passwords all the time but only people near me can steal my phone.

Seems better right?

Answer 1

Using a phone is another way of using multi-factor authentication, and certainly enhances security if done correctly. It is not a substitute for a password or other information, but often times authentication uses both "something you have" and "something you know" concurrently to verify, as it mitigates the possibility that either a) your password is stolen and b) your phone is stolen or hacked.

Stated differently, if you have your phone and someone hacks your password, this can stop them from obtaining unauthorized access. If you have your password but someone steals your phone, this can still stop them from obtaining unauthorized access. Someone would have to have your phone AND know your password to many any major changes, which is an additional safeguard.

While it is a secure method, there are two major drawbacks: 1) the obvious, that if the phone is lost, stolen, replaced, dead, etc, this entire process is moot. If there is no password, there is no workaround. 2) This is a cumbersome process that most users would not want to do. Despite these difficulties, 2FA is becoming more mainstream because it is far more secure than JUST a password or JUST a text.

In terms of security, this is not necessarily "more secure" or "less secure" if you use just one method (phone); they are susceptible to different forms of attack. You might consider it slightly more secure overall, assuming that nothing ever happened to the phone - but that's part of multi-factor authentication. But even so, protecting the phone is still only half of the battle. MitM attacks to receive the text, for instance, are new threats here compared to a password using SSL/HTTPS. Moreover, the random value can potentially be guessed via rainbow attacks.

You'd probably be better off forcing stronger passwords to balance convenience.

Answer 2

Password is something that a user would know, but not necessarily expose. The phone is something that you keep close to you, but it is regularly exposed, sometimes left unsupervised, periodically non-operational.

Knowledge can be hijacked\captured when you type it and send your credentials over the network.

Phone can be snapped from you in public transport or on the street, etc... It can drain it's battery deny you logon ability. Network coverage can vanish and leave you helpless.

Changing a password is usually a trivial task, what about the phone? I go abroad and I might be using a diffrent phone there, not an everyday problem, but that just adds a little bit more complexity.

I can see how phone is a less reliable option with more external risks and dependency. I also assume your users would be people with different kinds of phones, carriers and habits, potentially introducing even more scenarios where the phone would hinder their ability to be authenticated by your service.