CODEWITHSUNDEEP
phpobjective-csecurity
Gerard de Jong
Gerard de Jong

Reputation: 618

Alternative method for 2 factor authentication

Scenario: I want to create an app where users register accounts and a server sends them a one time pin to verify their contact details via SMS. User enters the code received to verify their details.

However, sending an SMS costs money but receiving one is free and my SMS gateway lets me read incoming SMS messages.

So I could create a screen in my app that lets the user send an SMS to my gateway with the gateway number and message prefilled (eg. "Hi, please activate my account with code: 34GKTT551T"). User only needs to press send.

Instead of having the user type in a code they've received and verifying the code on the server, my gateway picks up a code sent by the user and sends the message to my server which then verifies the code and thus validates that the users phone number is the one they entered on registration.

Question: Is there anything fundamentally wrong with this approach?

What are the pros and cons of doing things this way? Yes, I know SMS messages can be faked but it's harder than faking an email which could also be used. I would not consider this an alternative to proper 2 factor authentication but this approach worth doing as a lower cost alternative that doesn't require users to do anything else special.

PS. This is my first question on stack overflow so be nice.

Upvotes: 1

Views: 415

Answers (1)

SilverlightFox
SilverlightFox

Reputation: 33578

No this is not secure as the sender of an SMS can be easily faked. Take these instructions for how to achieve this on Kali OS.

There are also services such as this one.

All it would offer is a very thin layer of security against people who have the user's password but do not know the above information or the mobile phone number of their victim. The phone number of their victim may be achieved via other means such as social engineering. It may work if there is a separate phone used for the sole purposes of 2FA, however why not go with using Google Authenticator API, which is free (Google Authenticator app available for iOS and Android)?

Upvotes: 1

Related Questions