Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why nobody use it? It's cheaper and almost everybody uses messengers.
Safe is a peculiar word choice to describe the medium choice for a 2FA message that actually might describe several desperate qualities of a 2FA medium. Through the lens of security.
2FA is often used to provide authentication based on something you have instead of something you know. For this perhaps the ultimate device is an offline security dongle that generates time based codes with a secure algorithm.
SMS provides a similar property as it tends to demonstrate that the user is in control of a specific mobile phone. Changing the phone to which SMS messages for a number are delivered is not simple and requires either physically changing a SIM card or dealing extensively with a phone provider. SMS is less secure in the age of smartphones because the phone may actually be where the password was compromised in the first place so the attacker might obtain the SMS codes the same way.
Using a telegram message would be similar to sending a confirmation email. It does prove that the person has access to an account, but little more. Provided that the service has excellent MFA and security in general, this approach might leverage the authentication service there. Ultimately if the other service is username and password based only, the additional security is probably not particularly significant.
In case of the telegram to login into new device you need to use telegram confirmation from already logged in device or SMS which telegram sends. So I think it's not only "something you know". The first hand SMS confirmation is of course better btw. Nov 8, 2018 at 8:18
1@PilgrimViis I think that the approach is reasonable and definitely adds to the difficulty of using a stolen password, particularly with a paranoid service like Telegram. It might actually be worth looking into OAuth based logins with trusted providers. This is usually free and is already designed and audited by security professionals. Nov 9, 2018 at 0:05
There is a couple of reasons that keep SMS a superior and safe choice as a mean for communicating 2AF code compared to the other messaging systems like Messenger or WhatsApp:
- SMS is built-in feature on mobile phones, you don't have to install it and you can not uninstall it intentionally or accidentally.
- Not every customer has a smartphone unlike a plain GSM mobile.
- Hypothetically, if all customers have a smartphone, you don't control which Messaging app each one has to install.
The word "Safe" here is pointed out from business perspective and doesn't imply SMS as a system is more secure.
3Good points, although I think calling SMS "safe" might deserve some qualifiers. Nov 7, 2018 at 15:46
@user8675309 "Safe" here is used from business perspective and it is not meant to indicate SMS system and infrastructure are more secure.– elsadekNov 7, 2018 at 16:28