I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?

Is it secure? I think it is not a good practice to rely authentication only on such codes which come on mobile phone, because someone can just steal your mobile phone and that's it.

I think better alternative would be to combine the above mechanism with a username/password authentication. What is your opinion? What are the best practices in such direction?

  • I think it fully depends on the use case, the threat model and attack scenarios. It apparently has enough security for many promotions where you get a unique number hidden with a product. Is it enough for online money transactions? Probably not. Commented Aug 2, 2013 at 10:58
  • This is called two-factor authentication, many services (incl google, facebook, etc) use this today.
    – JimL
    Commented Aug 2, 2013 at 10:59
  • @JimL if you regard the phone to be something you have then it is two factor authentication - but the line between one-factor and two-factor are a bit blurred here; if I retrieve the one time password (e.g. by listening in on the GSM network) then it becomes something you know - leaving only a single factor... Commented Aug 2, 2013 at 11:02
  • I think the way it is now, it is one factor authentication - because if someone steals your phone, he can authenticate as I mentioned using the code he receives on SMS ... Commented Aug 2, 2013 at 11:15
  • @owlstead in practice a combination of password+text message is often used by banks for micro transactions up to about 250 USD. Commented Aug 2, 2013 at 11:18

2 Answers 2


I'd say just a code on the phone is weaker than username and password (because you can loose a phone and someone might abuse it). Combining them is a form of multi-factor authentication:

  • something you know (password and username)
  • something you have (phone with text message)

and depending on the level of authentication you need, this is considered a good and strong form of authentication.


Out of band One Time Passcode designs like this are typically called multiple single factors and are quite common, especially where privilege escalation is required when the user is already logged on, e.g. making a transaction.

Mobile phones are just always-connected small computers nowadays and thus aren't a second factor - so I don't consider any of the following authentication methods as "second factor":

  • bluetooth auth (is supported by some unlock screen saver functionality)
  • SMS one time passcode
  • NFC (used for micro financial transactions)

Multiple Single Factor can be stronger than single factor, although take care because asking a user for 2 text passwords isn't much stronger than a single factor password request.

Not the answer you're looking for? Browse other questions tagged .