0

I am creating an app. Users need to both login and sign-up. I want to simplify the form for this process as much as possible. This got me thinking. Instead of doing the traditional email, confirm email, password, and confirm password setup for sign-up, I just want to use the user's phone with a sms text verification process. If the users account does not exist, I would create a new one after the sms verification is completed.

In a similar fashion for login instead of email and password, I would just use the same phone number with sms verification. If the user exists in the db then I would verify the phone number via sms text and allow the user to continue.

I have never seen this done. I was wondering is this bad practice from a security perspective? My immediate thoughts are no this is not bad practice, but only if I verify the phone number every time via text.

I have heard of passwordless login with email where a link is sent via email to the user for login with no password. This is very similar to the process I am recommending. Are their any case specific concerns I should have with phone via sms or Whatsapp?

The most important info on my app is credit card info, and I won't be storing it in our DB's, but if a malicious attacker gets in they can charge the user unexpectedly. To reiterate this is only if they take control of the phone's sms/Whatsapp text capabilities.

Do I need to be concerned with a lost phone scenario? Last I checked the process for lost sims is very secure from a carrier's perspective. If the carriers process is insecure I know I am screwed, but I feel like that is equivalent to a bank robing its own depositors type of scenario. At that point the world is screwed anyway because 2fa would be exploited.

I am only going through this process because I am paranoid with user data. I want to limit the amount of user data that I have to just phone-number and sometimes cards, but if I can get away with it no credit cards as well.

4 Answers 4

0

I found some important info regarding my own question.

Is Auth0 Passwordless Authentication secure?

https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/

To answer my own question. Their are some potential vulnerabilities. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/

  1. Governments can hack sms for 2fa which would give them access to everything in my app.

  2. it seems that a social engineering attacks have worked on carriers before. According to the above link this was deployed against blm org leaders.

These are the world falling apart scenarios which I alluded to. In the end would be at the mercy of the systems process.

Their are ways that this can work better

  1. Using other MFA processes like yubi-keys, and google auth in the mix for extra protection

  2. Picking a good carrier. I don't like this answer.

The links above also mention that passwordless protection in some ways is better then password protection because the user is verified every time and no password vulnerabilities are introduced because there aren't any passwords.

0

Do I need to be concerned with a lost phone scenario? Last I checked the process for lost sims is very secure from a carrier's perspective.

One the carrier is aware of this, their processes may be fine. But if I'm walking along the street and find a phone without a PIN (or a weak PIN), I have immediate access to someone's account. Or equally if someone leaves their phone lying around unlocked, in a few seconds I can login to their account without needing anything else. Although if they saved their username and password on the phone, the same would also be true..

I have never seen this done. I was wondering is this bad practice from a security perspective?

Availability is part of security, so you should be thinking a bit about that as well. If your login is based around sending an SMS, you're making your unavailable whenever someone doesn't have phone signal, and potentially making it expensive to use when they're abroad. You're also potentially making it unavailable to anyone who doesn't have a mobile phone (and may be trying to use it from a tablet/etc) - although depending on your app that may be fine.

0

Receiving SMS is not reliable, especially when traveling abroad. It is also subject to delays. The message may arrive late. This will cause friction and a poor user experience.

Plus, you are going to incur sending fees which can add up with volume. E-mail is cheaper.

And not everybody is willing to provide their phone number immediately upon registration. If you ask for an E-mail address, at least people can still choose not to provide their main E-mail address by using a burner or secondary address instead.

I am not even taking about SS7 attacks.

In terms of security, I do not see any particular benefit. Better security is achieved with multi-factor authentication, for example using OTP rather than SMS. So, relying exclusively on one method - in this case, phone numbers - cannot be described as good practice.

If you want to make it simple for your users: require E-mail + strong password. If you are not even collecting other personal information, then your signup form is as minimalistic as it gets. To make it more secure for your users: add MFA.

0

There are many reasons not to do this. A few that I haven't seen mentioned already:

  • People change phone numbers sometimes. Under your system, they would not only permanently lose access to their account when they do so, but whoever gets their phone number next (yes, they're recycled, typically within a few months) will have immediate access to the prior owner's account.
  • Phone numbers are sometimes shared. For example, my parents have only one consistent phone number (they travel extensively, and use local SIMs wherever they are, but maintain a single US number at all times); this system would prevent such people from having separate accounts, or from having an account the other person couldn't access. Phone numbers are not intended to uniquely identify a person and should not be assumed to do so!
  • Intercepting SMS is remarkably easy if you're close enough (or at least was, back about a decade ago; I don't know if it's gotten better) using modified "femtocells", devices that are effectively short-range cell towers. Some colleagues of mine once demonstrated how easy it was by intercepting messages by accident while messing with a femtocell.
  • Both stolen phones (whereupon a physical SIM can be extracted and used even if the phone is locked with a strong password) and SIM-swapping attacks (where the attacker socially engineers the carrier to issuing them a new SIM by claiming to be the legitimate owner and have lost their phone) are very real threats that have occurred many times in real life, sometimes leading to enormous damage. Carriers have gotten better about securing against malicious SIM swaps but they still have a ways to go, and while eSIMs are harder to steal than physical ones, physical ones are still common and almost nobody password-protects them.
  • People who don't have phones, or at least not cell phones, can't use the service at all. These days that mostly means children, senior citizens, and people from poorer parts of the world, but it's potentially significant.
  • Some carriers still charge people to receive SMS (though they really shouldn't; it's literally free for them to transmit the message).
  • Security-conscious users will want to use a second factor, ideally one that prevents phishing (e.g. something FIDO2-based, like a Yubikey or Webauthn platform authentication); you don't have to cater to them, but forcing people to use nothing but one of the least secure forms of authentication out there - one generally seen as of questionable value even as only a second factor - is a bad look.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .