4

I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone.

How practically safe is this, and what are technical/social exploits that should be considered?

Also if you have any comments on the general level of risk this may have please reply.

1

A few quick things that come to mind:

What is the method of entry? If the user is inputting the password into the "chatbox", you run the risk of someone simply looking over the users shoulder and seeing the password.

Will you be using rate-limiting? SMS messages, while very cheap, are not free to send. You don't want to foot the bill when Joe decides to send ten-thousand password-reset messages to Carl. You'll also need to rate-limit entries, to avoid someone brute-forcing all possible combinations. Make sure you do this by both username and IP.

On that topic, you'll need to have a fairly long authentication code: most 2FA sites use 2FA as a backup method of authentication, not the "keys to the kingdom". Since you're relying to heavily on the server-generated code, you'll need to make sure it's long enough to make distributed brute-force infeasible.

You'll have to make sure to explain what the message is, in the body of the message. For example, "Your WidgetCo password reset code is: 123456" - this way, people can know that they're under attack, as opposed to just getting a bunch of random numbers over text (although since there's no other authentication, users can't do much even if they know they're under attack).

Finally, keep in mind that you're also at the mercy of the mobile carriers security - all this is for naught if I can just call up Verizon and social engineer them into telling me the text.

Overall, I'm not certain this is a great idea - using an email for recovery (with 2FA) would make more sense, and using OAuth would be much more secure, while being much less of a headache for you.

  • 1
    I surely hope that Verizon support has no access to the content of text messages. – Martin Schröder Dec 7 '17 at 6:40
  • @MartinSchröder That's a good point - a cursory search online pointed towards the carriers having near-complete access to the contents of the message, but also indicated that it would be near impossible to socially engineer access to the messages, due to the fact that carriers often can't legally give the messages to anyone, unless it's for a criminal investigation. – Cowthulhu Dec 7 '17 at 14:54
  • Although keep in mind that if they have access to the messages, so does Joe Hacker (although I would like to naively believe that mobile carriers have exceptional security). – Cowthulhu Dec 7 '17 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.