logo
logo
Sign in

The Problem With Two-Factor Authentication Solutions Using SMS

avatar
Thai Bulk SMS
The Problem With Two-Factor Authentication Solutions Using SMS

A growing number of websites and online businesses are today getting started to utilize smartphones as a secondary method for authentication. Certain online banks are using SMS OTP, but more recently major businesses and websites that aren't in the regulated sectors are realizing the need for more secure online authentication. In the spring of this year, Google introduced two-factor authentication to all users. In the last few days, Facebook has also introduced two-factor authentication.


It's great to know that more sites are enhancing the online authentication. If you consider the amount of sensitive and personal data individuals are sharing on the Web using one level of protection for passwords isn't enough. But, sending a one-time security code or password through an SMS messages is insecure, as they're typically delivered in plain text. Mobile phones can be lost or stolen. If another user has the phone of the user they may be able to see messages in text and use it to fraudulently authenticate. SMS messages can be intercepted, and then forwarded to a different phone number, which allows a cybercriminal to obtain an authentication number.


As more companies rely on mobile phones for authentication outside of band as a security measure, hackers are increasingly targeting this avenue for attacks -which means that businesses must employ a more secure method than a simple text message. The challenge for websites catering to the consumer is to find a balance between strong security and usability. Complex security strategies won't be popular with Internet users.


An easier and safer to use method is to display a kind of challenge based on images on the smartphone of the user to establish an unique password (OTP). Here's an way it could be accomplished: During the first time registration or enrollment through the website, they pick some categories of items they're able to recall like flowers, food and cars. If an out-of-band authentication requirement is needed and the company is able to initiate an application that runs on the smartphone of the user to display a random grid of images. The user is authenticated by clicking on the images that are in the categories they have chosen for their secret. The pictures on the grid differ every time, however the user is always looking for the identical categories. This way, the authentication challenge creates an unique, photo-based "password" that is different every time . It is a real OTP. The user just must remember their three main categories (in this instance, cars as well as food and flowers).



One of the most important aspects of security is the ease of use. The majority of Internet users will not accept security measures that are cumbersome and most companies don't wish to burden their customers. Images-based authentication is much simpler for users since they just have to keep only a handful of categories of their most-loved items and tap the relevant images on the phone's display, which is much more simple than writing long passwords on a phone's tiny keyboard or accurately copying an alphanumeric code from a text messages inbox from the phone to the website on the computer. In fact, a survey conducted by Javelin Strategy and Research group confirmed that 6 out of 10 consumers prefer easy-to-use authentication methods such as image identification/recognition.


Businesses and websites should follow the lead that was set by Google and Facebook with the introduction of two-factor authentication for their users. As criminals continue to use mobile authentication and steal SMS messages, it will become crucial for businesses to implement the knowledge-based authentication problem instead of providing an encryption code in simple SMS text messages.


collect
0
avatar
Thai Bulk SMS
guide
Zupyak is the world’s largest content marketing community, with over 400 000 members and 3 million articles. Explore and get your content discovered.
Read more