Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another number.

So the question is why don't mobile apps require you to send a message to authenticate?

marked as duplicate by Rory Alsop Dec 13 '18 at 22:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    What's to stop someone from forging the source number? – multithr3at3d May 9 '18 at 23:34
  • 1
    Are you saying you know this is possible? – Bruce May 9 '18 at 23:42
  • not for sure, but it's done often with phone calls. SMS is quite outdated and insecure as you noted, so it could be possible. Maybe someone else will know more – multithr3at3d May 9 '18 at 23:45
  • 1
    I've not tried, but sites claim to do it: spoofbox.com/en/app/spoof-sms – multithr3at3d May 10 '18 at 2:38
  • 1
    Wow, it's that easy, authenticating over the SMS system is really not fit for purpose. Inbound messages are certainly the harder to spoof it seems. – Bruce May 10 '18 at 10:26

Why not use inbound SMSs

There are many reasons, some of which are:

  • Most carriers allow free text receipt, even on PAYG, but many do not allow sending unlimited texts for free
  • There are still ways to spoof the source of an SMS, so this would not add much more security
  • Most carriers support having auth texts sent with an alphanumeric name, which makes them easy differentiate, but inbound texts cannot be sent to alphanumeric destinations Source
  • If there were multiple numbers user's would need to know which one to send messages to, so their message goes to the right destination

Not the answer you're looking for? Browse other questions tagged or ask your own question.