Say we have a system where we register users by a username and a phone number, could said system authenticate the user purely based on his username and an OTP sent to his phone number (assuming that implementation cost isn't a factor)? How secure would this be?

  • 1
    Given that there are quite serious questions being raised about the use of SMS for a second factor, using it as a sole factor seems potentially dangerous...
    – Matthew
    Commented Oct 31, 2016 at 10:28

3 Answers 3


It would be as secure as the phone and the token transfer is. I.e. if the user looses the phone or if the phone gets compromised by malware or if the user displays incoming messages on the lock screen so that others can see it too or if someone can capture the SMS (or whatever you use to send) then the you've lost. Insofar it is similar to sending the token per email and hoping that only the user has access to the account and that nobody can sniff the transport of the mail.



  • More secure than easy to guess passwords.
  • The user won't rely on a password manager or his/her memory to remember the password.
  • Users won't be able to share passwords with anyone even if they want to.
  • There are many mobile applications that uses similar method of Authentication. There are many mobile applications that uses similar method of Authentication. Hence it is a tried and tested method.


  • You will have to assume that user always has his/her phone.
  • You have to assume that they are always in network coverage area.
  • For users who don't keep their phones password protected are at high risk.
  • Users who have onscreen notifications on can be at risk. However if you send the OTP towards the end of the message, most of the phones won't show it onscreen.
  • There are softwares that can be used to spy phones which can be present on a user's phone. Without a password, the attacker can directly login to the account.


For added security, send half OTP on phone and half on the email. That would be a lengthy but relatively secure method. And I think this method can't be called 2FA as :

Both of them is something you have.

  • "Users won't be able to share passwords with anyone even if they want to" Bad assumption to make. My Google authenticator is on all my devices. whatever generates the OTP must be able to reproduce if it's not then it's not using any standard that should be used
    – Ramhound
    Commented Nov 1, 2016 at 2:06
  • I am assuming that op wants to send the OTP to user's mobile as an SMS. @Ramhound
    – Sanidhay
    Commented Nov 1, 2016 at 9:11

Hmm, It would be secure provided, as pointed by Steffen in an answer(not duplicating it) these things don't happen to you(phone getting lost, phone showing password on the lock screen, infected by malware et al).

What you can do alternatively is you can ask for a random string also during registration(much like a password, hence with greater entropy). And set the password as OTP+Random_string. Ask the user to enter that in the password field with username as mobile number(or whatever you want), That would solve the problems as stated by Steffen. Hence would be far more secure and almost at par with 2FA.

Hope this helps!

Not the answer you're looking for? Browse other questions tagged .