1

I was reading up on the latest security meta for 2fa and learned that sms is not a secure way to conduct device verification due to phishing concerns. It seemed most articles/blogs stressed the importance of push notification authentication. Essentially, you get a push notification sent to your phone on every log in attempt, which allows you to confirm or deny the attempt. However, this is all contingent on already having third party apps installed, like Authy, which have api's that send and receive the notifications.

However, requiring users to already have a separate app installed would pretty much murder sign up conversion rates, specially in the beginning. Yet it seems that if I were to build out a push system endemic to my app, it would have the same functionality, while cutting out the third party, since all they really are offering is an existing api (which seems easily replicable). Is this correct? Or would I be missing some security features that only existing third party apps have?

(Let's assume that we're only worried about phishing/MITM/social engineering attacks which aim at stealing log in credentials/one time passwords and not actual stolen phones, in which case my proposal would have obvious problems, since the push system is tied to the app on that physical device)

Improve this question
2
  • What do you mean by "build out a push system endemic to my app"? Do you have an app that you didn't mention?
    – David Z
    Apr 7, 2018 at 8:25
  • I understand the question this way: If he does push notification - does the user need to install a special app or would a push notification /authentication already work out of the box with iOS or Android - like getting a push notification, hitting yes or no on the push notification and providing some callback link. (This would actually work without a 3rd party app)
    – cornelinux
    Apr 8, 2018 at 15:17

2 Answers 2

Reset to default
1

When you are using SMS, you are authenticating the user's sim as the additional factor. Whereas in case of push notification, the user's mobile device is acting as the additional identity provider.

You can definitely use push notification from your app to authenticate the user's mobile device and will not be missing on any functionality from security point of view. Apps like authy provide more convenience to the user as it provides second factor in different forms and not just push notification. For example, push notification might not work when the device do not have an active internet connection. Apps like authy or google authenticator also provide the time stamp based soft tokens that works even without internet.

If more people go with authy you can safely assume that many of your users have it by default and it doesn't act as an additional barrier for most of your user base. It is a trade off on convenience than security on whether to go with authy or any other third party vs. sending push notifications via your own app.

Improve this answer
1

You certainly can implement this by yourself instead of a third-party.

You can either send a push notification or implement an OTP (which is less comfortable but in general more secure as there will be no tapping by mistakes, only intentional insertion of OTP code, and in addition, more reliable in case of unstable network connection)

Third-party authentication apps like Authy just simplifying this for you and usually, the user will use additional applications that require 2fa of a sort.

Improve this answer

You must log in to answer this question.