Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience and I was thinking to implement it on our app/website too but isn't this "very" insecure? I can imagine several issues:
- the phone number is easy to guess: This allows the attacker to run successful blind SPAM campaigns even location-based(state, city based on the prefix). If most of the internet users would use phone numbers instead of email addresses I'm sure the amount of spam they receive would be higher. The spammers won't need to worry about email addresses harvesting. They would just generate phone numbers with a good chance to catch valid/active ones.
- the sms is insecure: Unlike the email service the SMS has no authentication protocol(as far as I know) such DKIM, SPF so even experienced clients are unable to verify the integrity of the sender(i.e. if it's twitter or a spoofed number). Once you register/authenticate with the phone number you also establish SMS as communication channel. So it's not only the authentication code that you receive through sms but all the communications (confirmations or whatever twitter sends) are are sent though a channel which doesn't support authentication. This is basically like email without DKIM, SPF and even without any SPAM filter.
- disturbance: brute forces most of the the valid phone numbers just for fun to generate disturbance(i.e. make twitter send auth codes to all the possible phone numbers). There may be sensible IP restrictions but I can't see this stopping the attacker.
data harvesting -> malware: The attacker finds what phone numbers are registered on twitter(see brute-force), sends them SMS (which looks like a twitter notification) with malicious links.
- phishing: the client may be more willing to disclose a code received through sms than a password. If a phishing form is asking for a sms received from twitter(MITM) I think the client is more willing to provide it than a password as the code is received on request (not expected to be a secret the client is remembering) and the process( wait for the SMS and copy/paste it) distracts the client from the login page. It's also worth to note that the SMS notification covers the header of the UI(address bar).