1

Passwords can often be hard to remember. This leads to people using the same password for multiple websites.

If one was to use an authentication app (or SMS) instead of passwords (for a web application), would that provide a higher level of security than an ordinary password (not considering 2FA)?

If so, could this level be increased eliminating the need for additional hardware by let's say using email as a target for one-time confirmation codes for unknown devices (Of course email accounts can be hacked into but I want to leave this aside for this case)?

0

Functionally, when you use SMS or Authentication App on a mobile phone, you make the security rely on something you have. It has been used for centuries for house keys, so it is not fundamentally bad...

You can even make it look like a 2FA system if you phone requires a password each time you use it, and the SIM card also do. But... it is limited by construction to apps based on phones or tablets.

Password is something you know and is almost as old: safes using combinations also exist for centuries. You have shown the dark side: a good password should be easy to remember for the owner, and impossible to guess for anybody else... which is really hard to find. Worse, good practices recommend to change it on a regular base, which comes close to impossible.

But a password base system can simply be improved with a password vault and a correct random generator. Such vaults exists on almost any systems, and some like the excellent keypass have versions for different OS, that can be synchronised either locally or through internet storage like DropBox. Then the password is true random and can be changed at will, and the security relies on the vault (that can have backup copies) and the master password that is never exchanged outside the device (or PC).

So you system can be better than a trivial password, but it depends on specific hardware, while a password system can be as secure and is fully portable and can provide protection against device loss.

I do not want to say that SMS or Authentification App are bad. I am even pretty sure that they fit perfectly some use cases, but IMHO the good old password system is still appropriate for many others.

1

Sms or authenticator based login can provide a better security in the sense that you negate lots of attacks like dictionary and brute force. It is not a fail-safe mechanism though.

There are some problems that are caused when you use just sms or app based systems:

  • If you lose your phone, you can't login till you get a new sim at the very least.

  • If you lose your phone and is found my some malicious person, it is very likely that your email would be synced on your phone. They can try to login to your website and both email(one of your alternatives) and sms based tokens will be available to the attacker.

As you already mentioned in your question, 2 factor is better than this. If you had to use a single factor, choosing one that is always guaranteed to be known to the user would be better.

EDIT: There was a comment about device encryption and passcodes to protect the system. Majority of Android phones that I have seen use patterns which are not very secure as mentioned on Android SE . Also, whether to use this technique eventually depends on your threat model and assumptions on user's level of maturity. If the users of your app are expected to keep their devices safe, then great otherwise it's a risk.

Opinion: I agree that if they lose their phone, you can have a forgot password kind of prompt but that is still not good enough according to me.

2
  • Regarding third parties obtaining physical access to your device: most people have pass codes on their devices and (at least iDevices are encrypted so that would be safe). Regarding the situation when the user loses the phone and needs to log-in, a pre-set code (during the setup of this authentication system) could be used to turn the feature off and revert to a standard password (much like Dropbox uses for 2FA).
    – J. Pinkman
    Dec 17 '16 at 17:18
  • @O.Doe patterns are not a very good protection: android.stackexchange.com/questions/18763/… and most of the Android users that I have met use patterns for protection. Yes, your tech savy ones would usually keep their phone encrypted and wipe the screen so that the pattern can't be identified by smudges but still
    – Limit
    Dec 17 '16 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.