1

Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and the sms session id (8 digits). User then should verify that sms session id in sms matches one in web site UI and only then enter the OTP. If sms session id does not match, user should stop and avoid entering OTP.

Wondering is this kind of workflow made for security reasons? And verification of sms session id protects from some kind of attacks?

One example of such workflow: webmoney.ru

Improve this question

1 Answer 1

Reset to default
1

My guess would be that they're trying to prevent you from entering your OTP on a phishing page. If that's the case, their solution is wholly ineffective.

If you're on a phishing page and you receive a valid OTP, that must mean that the phisher has already entered your username and password to trigger the 2FA. They can simply take the "session id" that's sent to them and forward it on to you, and you'll be none the wiser.

4 digits is also rather short for an OTP. 6 digits is common, 7 or 8 is better. Without proper throttling or account locking 4 digits is trivial to brute force. Even if they throttle it to 1 attempt every 5 seconds it'll take under 10 hours to have a 50% chance of guessing a correct code (of course you'll hopefully notice your phone blowing up with a large number of OTPs during this time and change your password, but still...). And that's not even considering the fact that SMS isn't a secure channel.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .