3

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another number.

So the question is why don't mobile apps require you to send a message to authenticate?

  • 1
    What's to stop someone from forging the source number? – multithr3at3d May 9 '18 at 23:34
  • 1
    Are you saying you know this is possible? – Bruce May 9 '18 at 23:42
  • not for sure, but it's done often with phone calls. SMS is quite outdated and insecure as you noted, so it could be possible. Maybe someone else will know more – multithr3at3d May 9 '18 at 23:45
  • 1
    I've not tried, but sites claim to do it: spoofbox.com/en/app/spoof-sms – multithr3at3d May 10 '18 at 2:38
  • 1
    Wow, it's that easy, authenticating over the SMS system is really not fit for purpose. Inbound messages are certainly the harder to spoof it seems. – Bruce May 10 '18 at 10:26
4

Why not use inbound SMSs

There are many reasons, some of which are:

  • Most carriers allow free text receipt, even on PAYG, but many do not allow sending unlimited texts for free
  • There are still ways to spoof the source of an SMS, so this would not add much more security
  • Most carriers support having auth texts sent with an alphanumeric name, which makes them easy differentiate, but inbound texts cannot be sent to alphanumeric destinations Source
  • If there were multiple numbers user's would need to know which one to send messages to, so their message goes to the right destination

Not the answer you're looking for? Browse other questions tagged or ask your own question.