Consider the following (real-world) scenario: When making a credit/debit card purchase online, the bank sends an SMS containing 4 different numbered “passwords” and then prompts the user to enter a specific one (1, 2, 3 or 4).

What security advantages does this provide, as opposed to just sending one single code?

  • 1
    Don't underestimate the perceived value of security theater. – a CVn Oct 30 '17 at 19:25

It does not add anything.

The problem with is SMS as 2FA is that a SMS can be intercepted in transit, or grabbed from the user phone because of malware. Sending one, four, or one hundred codes is the same. If the attacker can get one, can get all of them.

You could give the user a card with hundreds of codes and send a message asking for a specific one, like this:

enter image description here

This way, unless the attacker gets the password card AND intercepts the message, the user is protected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.