Say we have a system where we register users by a username and a phone number, could said system authenticate the user purely based on his username and an OTP sent to his phone number (assuming that implementation cost isn't a factor)? How secure would this be?
It would be as secure as the phone and the token transfer is. I.e. if the user looses the phone or if the phone gets compromised by malware or if the user displays incoming messages on the lock screen so that others can see it too or if someone can capture the SMS (or whatever you use to send) then the you've lost. Insofar it is similar to sending the token per email and hoping that only the user has access to the account and that nobody can sniff the transport of the mail.
- More secure than easy to guess passwords.
- The user won't rely on a password manager or his/her memory to remember the password.
- Users won't be able to share passwords with anyone even if they want to.
- There are many mobile applications that uses similar method of Authentication. There are many mobile applications that uses similar method of Authentication. Hence it is a tried and tested method.
- You will have to assume that user always has his/her phone.
- You have to assume that they are always in network coverage area.
- For users who don't keep their phones password protected are at high risk.
- Users who have onscreen notifications on can be at risk. However if you send the OTP towards the end of the message, most of the phones won't show it onscreen.
- There are softwares that can be used to spy phones which can be present on a user's phone. Without a password, the attacker can directly login to the account.
For added security, send half OTP on phone and half on the email. That would be a lengthy but relatively secure method. And I think this method can't be called 2FA as :
Both of them is something you have.
Hmm, It would be secure provided, as pointed by Steffen in an answer(not duplicating it) these things don't happen to you(phone getting lost, phone showing password on the lock screen, infected by malware et al).
What you can do alternatively is you can ask for a random string also during registration(much like a password, hence with greater entropy). And set the password as OTP+Random_string. Ask the user to enter that in the password field with username as mobile number(or whatever you want), That would solve the problems as stated by Steffen. Hence would be far more secure and almost at par with 2FA.
Hope this helps!