Telegram (or other messenger) message as second factor in 2FA

Question

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why nobody use it? It's cheaper and almost everybody uses messengers.

Answer 1

Safe is a peculiar word choice to describe the medium choice for a 2FA message that actually might describe several desperate qualities of a 2FA medium. Through the lens of security.

2FA is often used to provide authentication based on something you have instead of something you know. For this perhaps the ultimate device is an offline security dongle that generates time based codes with a secure algorithm.

SMS provides a similar property as it tends to demonstrate that the user is in control of a specific mobile phone. Changing the phone to which SMS messages for a number are delivered is not simple and requires either physically changing a SIM card or dealing extensively with a phone provider. SMS is less secure in the age of smartphones because the phone may actually be where the password was compromised in the first place so the attacker might obtain the SMS codes the same way.

Using a telegram message would be similar to sending a confirmation email. It does prove that the person has access to an account, but little more. Provided that the service has excellent MFA and security in general, this approach might leverage the authentication service there. Ultimately if the other service is username and password based only, the additional security is probably not particularly significant.

Answer 2

There is a couple of reasons that keep SMS a superior and safe choice as a mean for communicating 2AF code compared to the other messaging systems like Messenger or WhatsApp:

• SMS is built-in feature on mobile phones, you don't have to install it and you can not uninstall it intentionally or accidentally.
• Not every customer has a smartphone unlike a plain GSM mobile.
• Hypothetically, if all customers have a smartphone, you don't control which Messaging app each one has to install.

Update:
The word "Safe" here is pointed out from business perspective and doesn't imply SMS as a system is more secure.