In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS.
Note, this would be used on a website that should never have more than perhaps 30 users.
I'm wondering if you could let me know if you see vulnerabilities in my setup and if so if you could suggest improvements.
Simplest version I could think of:
- The website asks for a phone number.
- User would type it in and submit the form.
- Form data would then be sent to the next page, where the php script would check the database to see if the number was there (and possibly check if the user has access to this particular page).
- If so, it would generate a random number (6 digits) and send it to the phone, via a web service, over https.
- The website would then ask for the number.
- The user receives the number in his phone, types it in and gets access.
What are the vulnerabilities in this setup? Is there a high risk that anyone would be able to type in a phone number (would have to know a matching phone number), and catch the generated random number, either between the script and the web service or between the web service and the phone?
Would you recommend using a username/password in addition to that (I want it to be as simple as possible, without it being too unsafe to use)? Any other suggestions?