In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS.

Note, this would be used on a website that should never have more than perhaps 30 users.

I'm wondering if you could let me know if you see vulnerabilities in my setup and if so if you could suggest improvements.

Simplest version I could think of:

  1. The website asks for a phone number.
  2. User would type it in and submit the form.
  3. Form data would then be sent to the next page, where the php script would check the database to see if the number was there (and possibly check if the user has access to this particular page).
  4. If so, it would generate a random number (6 digits) and send it to the phone, via a web service, over https.
  5. The website would then ask for the number.
  6. The user receives the number in his phone, types it in and gets access.

What are the vulnerabilities in this setup? Is there a high risk that anyone would be able to type in a phone number (would have to know a matching phone number), and catch the generated random number, either between the script and the web service or between the web service and the phone?

Would you recommend using a username/password in addition to that (I want it to be as simple as possible, without it being too unsafe to use)? Any other suggestions?

  • 2
    Are you aware that using SMS for 2FA has been seen as a risk all on its own? – schroeder Mar 7 '19 at 19:48
  • You are asking two different questions: are there vulnerabilities in the set up, and is the set up a sufficiant level of protection. These are 2 separate issues. We can't really answer the 2nd question without knowing what the threats and impacts are to a failure in this control. – schroeder Mar 7 '19 at 19:49
  • Why are you not using established protocols for this? Why are you trying to devise "the simplest version"? Do the 6 digits codes expire? Do you have any phone number verification process? Do you have a process for when a user changes their phone number? – schroeder Mar 7 '19 at 19:50
  • 1
    Everything has risks. SMS has been deemed to have an unacceptable level of risk for this purpose. – schroeder Mar 7 '19 at 19:56
  • 1
    Facebook is not exactly a shining example of a company that values user security... – Ghedipunk Mar 7 '19 at 20:04

To your first question, whether or not there are any vulnerabilities:

SMS is considered the weakest form of authentication, as the protocol does not give any guarantees to reliability or privacy. Additionally, it is very easy to re-assign a mobile number to another device, either through malicious conspirators working within or alongside mobile carriers, or through social engineering customer service representatives to believe that you are their customer.

Taking over an email address often requires, at a minimum, learning your target's password, where gaining access to their SMS messages does not require knowledge of any secrets, so email is considered a stronger second factor.

To your second question, would I recommend using it?

Since I have no idea about the nature of your site, its threats, and the data that you're protecting (and such an audit is well beyond the scope of this site), I can not give any advice except to tell you to do a security assessment with a proper risk/cost analysis.

That said, any additional authentication factors are always good.

Keep in mind that any password resets need to use factors that are at least as secure as a password. Pre-populated lists of (in)security questions that are personal but not private ("What street did you grow up on?") and tokens sent through SMS should be avoided, as they are significantly less secure than sending a password reset token as a link through email, as presumably the email inbox is protected by a password.

I personally choose to set things up with a combination of Time-based One-Time Passwords (TOTP) (RFC 6238, popularized through Google Authenticator) and a printable one-time-use recovery token (in case they drop their smartphone in the toilet), as well as also allowing U2F USB dongles (very user friendly: no typing needed) with either TOTP or the single user recovery token as the backup in case they put their USB dongle through the laundry a few too many times, as I have. While this is what I personally do, I stress doing your own security assessment.

  • Thanks @Ghedipunk. I will pick your answer, as it has got a lot of good information. Many of the comments were also helpful in finding more detail. I will probably use Google Authenticator now that I have read all of this. On your comment about email vs. SMS though, I'd like to point out that a lot of people have bad passwords or they are openly available after some website or other got hacked. While SMS has its insecurities, it would take somebody who knows what they are doing to get into a phone's messages, while I would think a lot more people would be able to find a password. – Andri Mar 8 '19 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.