I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the same way as you would use two-factor-authentication but without the password.

So far I couldn't find any. Does such provider exist?

If it does exist then what risks associated with such a use-case do you see?


  • Google sim swapping. If you're have any security concerns, this will prove weak. If you're only using authentication to handle something like theme customization, then maybe it's OK. – Neil Smithline Feb 12 at 20:39
  • This doesn't do it by phone number but does eliminate the password part of authentication: grc.com/sqrl/sqrl.htm – Bakon Jarser Feb 12 at 22:08
  • Unfortunately, questions of the type "what product/service does X?" are off-topic as the answer might change from day to day – schroeder Feb 13 at 21:10
  • SMS as an authentication factor has been deemed insecure for a while now. – schroeder Feb 13 at 21:11
  • I wasn't aware of sim swapping. Thanks for the pointers. Also sqrl looks interesting – vidi Feb 14 at 10:27

There is not, it's not based on FIDO

Look up sim swapping.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.