1

I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am never asked to provide my password. So unless I'm missing something, it seems Amazon is allowing an OTP to be used as a single factor of authentication. Is this really considered secure?

Amazon OTP sign-in

I understand OTP works well when combined with password in MFA, but I have doubts about using it as a single factor. It's bothering me that someone could gain access to my Amazon account without knowing my password, if they only manage to steal my phone or even just gain access to it for a few minutes.

Improve this question

1 Answer 1

Reset to default
5

I think you have already answered your question. There is no such thing as "secure" or "not secure", but you would have to compare the security controls against some security requirements or risk model. Your risk models are "someone gets access to my phone" & "someone can read my SMS". Against these risks the OTP only authentication is not adequate.

But with these risk models in mind, the password might not add as much security as you desire, because you can reset a forgotten password with OTP sent via email or SMS. If you have chosen password reset OTP via SMS, both your MFA factors are ultimately depending on the possession of your phone or another ability to read your SMS. Likewise, your phone would be a single point of failure in case you had chosen email OTP for password resets and SMS OTP for authentication, but received both with the same device – as most do.

Improve this answer
2
  • 1
    The risk model of "someone can read my text messages" is different from "someone gets access to my phone" in some very important ways. The latter is neither sufficient (phone itself could be protected by a PIN or biometric lock) nor necessary (text messages could be stolen my malware, attacks on backup systems, access in transit following encryption downgrade, number takeover and other social engineering attacks) and therefore possession of the phone really is not the issue.
    – Ben Voigt
    Jun 5 at 6:52
  • 1
    Thanks for your input. I tried to clarify that.
    – Esa Jokinen
    Jun 5 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.