Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile number is in access to user.
The way i am doing this is using users own Sim card to send SMS and doing all procces within the app.
It is as follows: first I generated a small random 6 digit code (OTP)
int otp = new Random().nextInt(900000) + 100000;
then, I send this OTP to the user-entered mobile number that I have to verify. I use the user's own SMS service to do this
SmsManager smsManager = SmsManager.getDefault(); smsManager.sendTextMessage(user_mobile.getText().toString(),null,"Otp for verification is: "+otp,null,null);
then, I create an Intent, start new activity and pass OTP to new activity
Intent itn = new Intent(MainActivity.this,OtpPage.class); itn.putExtra("Otp",s_otp); startActivity(itn);
and then, the user enters the OTP I sent, and I verify it with the OTP I received from the previous activity using Intent. If both are the same, I verify the mobile number.
Now my question is, Is this a valid way to do this or it contains some security flaws, if yes what security problems may arise here?