SMS and Two Factor Authentication
Way back when I worked the corporate life, my company used two factor authentication in order to access the corporate network. I carried around a little device, about a third the size of a credit card but a little thicker, that generated a random series of numbers every ten seconds. In order to log into the system I had to enter the usual user name and password, followed by this magical random number.
It all worked great, until I lost it. The first time you lost it they’d ask a few questions and give you a new one. The second time they’d call your manager. If you lost it three times within a short period (a year or so) then you’d really get into trouble. But they were small and easy to lose. They were important though, because they were one part of the two part authentication needed to get to the protected network which became vulnerable every time one was lost.
That scenario is how traditional two factor authentication works. In order to be authenticated you need two pieces of information, each provided by a different piece of hardware. These days though, many companies are using the same basic concept, but sending those random numbers to users via SMS rather than a dedicated device. That other piece of hardware is now your mobile. Now my mobile is something I’m not going to lose. At least I haven’t yet.
Major companies are implementing it this way. For example, if you forget your Google password you can get it reset by asking them to send a one-time passcode to your mobile. Then you have to go to a specific webpage, enter your user name and the one-time code to be able to reset your password. There are other services I use that require the same procedure every time I log in from a new device or from a different location (based on IP address).
It’s convenient to use SMS for authentication. Much more so than less secure means like email. I’ve used some sites that will send an email with a link to reset your password. That’s great, but the biggest issue I’ve found with that is waiting for the email to arrive. Sometimes it’s there before I can even switch tabs. Sometimes it never shows up. Other times I’ve waited so long I’ve given up and moved on to something else. But SMS is fast and the messages usually arrive in a matter of seconds. They also have an advantage over email because the code actually arrives on another device (rather than the link in the email which essentially has the code built in or sometimes provided separately in the email). It’s the requirement for another device that makes this form of two factor authentication using SMS secure.
Well, it’s secure to a certain point anyway. Without going into a detailed security discussion (which I’m not qualified to do anyway. I know something about the topic, but I’m not an expert!), there are arguments on both sides on whether it is secure or not. Or rather how secure it is.
Both sides agree that it is possible to hack two factor authentication when the passcodes are delivered via SMS. It takes certain hardware (which is readily available to those who know what to get), and while the network itself provides some encoding there are ways around that too.
But the truth is that those approaches to hacking the passcode aren’t that practical in most circumstances. Stackexchange.com is a technology website where people can ask questions and get the technical answers they need. Someone asked if two-factor authentication using SMS is secure. You can read the whole thread, but here is a quote summarising the discussion:
Also, in summary, it seems that SMS is a reasonably secure means of transmitting short-lived secrets, e.g. for two factor authentication. An attacker must know your (phone’s) physical location, know when you’re likely to receive a secret, possess and know how to use what is most-likely pretty expensive radio equipment, and have completed a fairly involved project to run “a truly massive computation” (correctly). Attacks would almost certainly be made only against very high value targets.
All these concerns are directed at someone being able to intercept the passcode, which is usually only valid for a short time after sending. But in order for the passcodes to be of use, the attacker would also have to have the first part of the authentication too – your user name and password for whatever service you’re using.
There have been reports of new hacking strategies that trick users into installing or downloading software onto a computer to capture this data. That software captures keystrokes to get your email and passwords, then provides a fake popup requesting you provide your phone number. Somehow then, the software (or the hacker behind the software) can now see both sides of the two factor authentication and the entire system is compromised for that user. This scenario though, points out the need to raise awareness of users so they don’t become victims to these types of deceptive tricks that hackers use to gain control of computers.
It’s really a much bigger issue than just what I’m addressing here, so for the sake of argument let’s assume no one falls for these hacker tricks. Then using SMS for two factor authentication can be considered secure for practical purposes (also assuming the SMS messages aren’t being forwarded back to your computer via email which then negates the point of the “two” in two factor authentication).
How to use SMS for authentication
The benefit of using SMS messaging for authentication is that people have their mobiles with them all the time. It’s convenient for them to receive the passcodes quickly so they can get logged in and do their business, whatever that may be. At its simplest, the procedure goes something like this:
- The user requests a passcode be sent to recover account information (a password, user name, account number, etc.)
- The server (belonging to the organisation who has the account information) generates a random code made of numbers or numbers and letters
- That one-time code is sent via SMS to the user at the mobile number provided in the user’s profile
- The user then enters the code into the webpage the server redirected them to when they requested the code
- The server authenticates the passcode (to check it’s still valid as well as the correct code) and provides the user with the means to access the account
If everything goes well the user is granted access and they can get on with their business. Organisations looking to do this sort of authentication can use APIs to connect to SMS service providers which then handle the message delivery. It can be an elegant solution when implemented properly.
The fastsms API is designed for just these sorts of purposes. Developers can quickly make the calls they need to send or receive messages and integrate with existing software. If you want to know more about our services, click the live chat button to speak with our experts right away. You can also use our contact form, call or email.
The Internet opened up mass communication in ways no one ever imagined it could. But there’s also another trend leveraging today’s communication technology: Communicating with just one person via applications. According to Transparency Market Research, the A2P SMS market will be worth over £45B in just a few years.
By 2017 there will be 270 billion app downloads worldwide. And the Google Marketplace and the Apple App Store each have over 1.3 million apps available. You need to help people find your app if you’re to break through all that noise. Your website is a great place to start promoting your app, but maybe not in the way you might think.
Enterprises are large companies. Sometimes that means they think they should be able to do everything themselves. But when it comes to SMS messaging, building an in-house gateway is more difficult than you might think. Read why finding a good SMS service provider is a better option.
The life of an IT administrator or manager is a constant battle with the equipment and software they manage. If an issue isn’t fixed in a reasonable time, there are usually consequences in one form or another. So how can you use SMS alerts to make sure your IT team is always aware of issues and the need to fix them quickly?
When handled correctly, SMS can be a dream partner for e-commerce and has a well-deserved place in your customer service suite. Once you have the all-important opt-in for SMS marketing compliance, you can begin to use SMS as a way to differentiate your e-commerce offer to make your customers' purchasing experience particularly pleasurable.
The benefit of using SMS messaging for authentication is that people have their mobiles with them all the time. It’s convenient for them to receive the passcodes quickly so they can get logged in and do their business, whatever that may be. At its simplest, the procedure goes something like this...
Is SMS messaging a good investment of your business’ time and money? A report from Mobile Ecosystem Forum shares some data on how SMS is being used, who is using it, and provides some evidence showing the answer to that question is most likely “Yes”!
The travel industry has made some inroads into using SMS messaging, but hasn’t yet taken real advantage of the potential of A2P messaging. Find out how it can be used to save time and provide the high-quality service today’s mobile travellers expect.