0

I am creating an app. Users need to both login and sign-up. I want to simplify the form for this process as much as possible. This got me thinking. Instead of doing the traditional email, confirm email, password, and confirm password setup for sign-up, I just want to use the user's phone with a sms text verification process. If the users account does not exist, I would create a new one after the sms verification is completed.

In a similar fashion for login instead of email and password, I would just use the same phone number with sms verification. If the user exists in the db then I would verify the phone number via sms text and allow the user to continue.

I have never seen this done. I was wondering is this bad practice from a security perspective? My immediate thoughts are no this is not bad practice, but only if I verify the phone number every time via text.

I have heard of passwordless login with email where a link is sent via email to the user for login with no password. This is very similar to the process I am recommending. Are their any case specific concerns I should have with phone via sms or Whatsapp?

The most important info on my app is credit card info, and I won't be storing it in our DB's, but if a malicious attacker gets in they can charge the user unexpectedly. To reiterate this is only if they take control of the phone's sms/Whatsapp text capabilities.

Do I need to be concerned with a lost phone scenario? Last I checked the process for lost sims is very secure from a carrier's perspective. If the carriers process is insecure I know I am screwed, but I feel like that is equivalent to a bank robing its own depositors type of scenario. At that point the world is screwed anyway because 2fa would be exploited.

I am only going through this process because I am paranoid with user data. I want to limit the amount of user data that I have to just phone-number and sometimes cards, but if I can get away with it no credit cards as well.

3 Answers 3

0

I found some important info regarding my own question.

Is Auth0 Passwordless Authentication secure?

https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/

To answer my own question. Their are some potential vulnerabilities. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/

  1. Governments can hack sms for 2fa which would give them access to everything in my app.

  2. it seems that a social engineering attacks have worked on carriers before. According to the above link this was deployed against blm org leaders.

These are the world falling apart scenarios which I alluded to. In the end would be at the mercy of the systems process.

Their are ways that this can work better

  1. Using other MFA processes like yubi-keys, and google auth in the mix for extra protection

  2. Picking a good carrier. I don't like this answer.

The links above also mention that passwordless protection in some ways is better then password protection because the user is verified every time and no password vulnerabilities are introduced because there aren't any passwords.

0

Do I need to be concerned with a lost phone scenario? Last I checked the process for lost sims is very secure from a carrier's perspective.

One the carrier is aware of this, their processes may be fine. But if I'm walking along the street and find a phone without a PIN (or a weak PIN), I have immediate access to someone's account. Or equally if someone leaves their phone lying around unlocked, in a few seconds I can login to their account without needing anything else. Although if they saved their username and password on the phone, the same would also be true..

I have never seen this done. I was wondering is this bad practice from a security perspective?

Availability is part of security, so you should be thinking a bit about that as well. If your login is based around sending an SMS, you're making your unavailable whenever someone doesn't have phone signal, and potentially making it expensive to use when they're abroad. You're also potentially making it unavailable to anyone who doesn't have a mobile phone (and may be trying to use it from a tablet/etc) - although depending on your app that may be fine.

0

Receiving SMS is not reliable, especially when traveling abroad. It is also subject to delays. The message may arrive late. This will cause friction and a poor user experience.

Plus, you are going to incur sending fees which can add up with volume. E-mail is cheaper.

And not everybody is willing to provide their phone number immediately upon registration. If you ask for an E-mail address, at least people can still choose not to provide their main E-mail address by using a burner or secondary address instead.

I am not even taking about SS7 attacks.

In terms of security, I do not see any particular benefit. Better security is achieved with multi-factor authentication, for example using OTP rather than SMS. So, relying exclusively on one method - in this case, phone numbers - cannot be described as good practice.

If you want to make it simple for your users: require E-mail + strong password. If you are not even collecting other personal information, then your signup form is as minimalistic as it gets. To make it more secure for your users: add MFA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .