Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this:
- Grab the mobile number, generate an OTP, cache it and send it via SMS.
- When the user introduced the TOTP, check whether there's an account with matching mobile number, creating it if necessary. The user is now authenticated.
My question is, how is this as safe as "tradicional" registration/login with a fixed password? If I'd be to implement the same flow on an application of mine, what pitfalls should I watch out for? How can I guarantee that a user's account is not compromised by such flow?