3

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS.

Since many people already know your phone number, or it may be listed publicly somewhere, why do websites do this? Is it just to add a small measure of security or to make the user feel good?

Improve this question
2
  • Does this service allow a user to have more than one acceptable phone number for 2fa? If so this is the mechanism to select which device to send the code to?
    – DarkMatter
    Jan 17, 2019 at 20:51
  • No it says something like "to protect your account please type in your number." Microsoft does something similar, asking for the last four digits.
    – John
    Jan 17, 2019 at 20:53

3 Answers 3

Reset to default
3

It is a continuation of the multi-factor approach. The phone number (that the service already has saved) could easily be looked up. That is, they could send you the SMS recovery code without ever asking you anything other than your user name.

But, by asking, the service is checking a "something you know" (normally a password, but now your phone number) token before validating the "something you have" token (your phone to receive the SMS). This means that even the password reset is a 2-factor-authentication operation.

It has the added benefit of preventing automations from using the service as a way to SMS spam folks (causing annoyance to the users, costing the service provider money for all the SMS transmits, and potentially setting up a [D]DoS scenario). The username and phone number have to match before the SMS message is sent, which is an efficient safety.

Improve this answer
6
  • Probably the second option. Because if they have the ability to receive your text messages, it is because they already know your phone number. It doesn't make it any more secure, but it could reduce spam to the user somewhat, like you say.
    – John
    Jan 17, 2019 at 21:55
  • That's actually an inverse fallacy. Like saying "if I can open your door it is because I already have your keys, therefore your lock isn't a security feature." The truth is that you will [hopefully] know if someone takes your keys or your phone, since they are physical tokens; and with that knowledge you can proactively modify your security threat model to account for them having that access (normally by changing the physical token -- rekey the locks or report your phone as stolen and cancel service to that SIM as you get a new one)
    – Ruscal
    Jan 17, 2019 at 22:02
  • 1
    It may not be strictly true that if they can receive your messages they know your number. But if you're looking at interception over the air or through some sort of a compromise of the cell network, then it is true. However, the one scenario I can see this helping with is the rare case where someone stole your phone, can't unlock it, but can still see your messages on the lock screen.
    – John
    Jan 17, 2019 at 22:22
  • True, and I discounted in-flight SMS interception as that is beyond the threat model these things are expecting (Stingers are far from cheap, or trivial, so to have one deployed against a user is an indication that the attacker in this model is on the scale of "governments"). But you're correct, I did not consider lock-screen leaks; I've made a habit to require unlock before displaying message content ("new SMS from <web site short code>" doesn't assist an attacker). And that was me allowing my bias to color the evaluation, thanks for pointing it out.
    – Ruscal
    Jan 17, 2019 at 22:26
  • Something that you and two thousands other people know is not "something you know". It's probably more appropriate if the adage had said "something only you know".
    – Lie Ryan
    Feb 16, 2019 at 22:55
0

First of all, SMS is still better than having no security at all, please do see this Why you shouldn't use SMS for two factor authentication (and what to use instead) article as it explains the pros and cons of having the mentioned controls in place.

Improve this answer
1
  • 1
    Good comment, but does not answer OP's question.
    – ThoriumBR
    Jan 17, 2019 at 21:33
0

I believe it's used to increase the difficulty of a random person trying to reset your password. This attacker would have to know your username AND your phone number, and most attackers don't have both.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .