3

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another number.

So the question is why don't mobile apps require you to send a message to authenticate?

Improve this question
6
  • 1
    What's to stop someone from forging the source number?
    – multithr3at3d
    May 9, 2018 at 23:34
  • 1
    Are you saying you know this is possible?
    – Bruce
    May 9, 2018 at 23:42
  • not for sure, but it's done often with phone calls. SMS is quite outdated and insecure as you noted, so it could be possible. Maybe someone else will know more
    – multithr3at3d
    May 9, 2018 at 23:45
  • 1
    I've not tried, but sites claim to do it: spoofbox.com/en/app/spoof-sms
    – multithr3at3d
    May 10, 2018 at 2:38
  • 1
    Wow, it's that easy, authenticating over the SMS system is really not fit for purpose. Inbound messages are certainly the harder to spoof it seems.
    – Bruce
    May 10, 2018 at 10:26

1 Answer 1

Reset to default
4

Why not use inbound SMSs

There are many reasons, some of which are:

  • Most carriers allow free text receipt, even on PAYG, but many do not allow sending unlimited texts for free
  • There are still ways to spoof the source of an SMS, so this would not add much more security
  • Most carriers support having auth texts sent with an alphanumeric name, which makes them easy differentiate, but inbound texts cannot be sent to alphanumeric destinations Source
  • If there were multiple numbers user's would need to know which one to send messages to, so their message goes to the right destination
Improve this answer

Not the answer you're looking for? Browse other questions tagged .