SMS-Based One-Time Passwords: Are They Really Secure?

As cyber attacks targeting user accounts continue to rise, companies face significant liabilities. A recent FBI report revealed that potential losses for American businesses and individuals due to cyber-attacks in 2022 amounted to an estimated $10.2 billion, a substantial increase from the $6.9 billion reported in 2021. In response to this growing threat, organizations have adopted innovative security measures such as two-factor authentication, including SMS-based temporary passes (OTP) to safeguard their clients.

While SMS OTP has demonstrated its effectiveness, the big question still lingers: Is SMS OTP secure? In this article, we’ll explore this critical question by delving into the benefits and varieties of single-use, as well as their strengths, weaknesses, and the process of generating them. By examining these aspects, we aim to provide a comprehensive understanding of SMS OTP security and its role in protecting user accounts.

OTP Markets and Key Industry Players

One-Time Passwords are quickly gaining traction in the cybersecurity landscape. Within this thriving sector, hardware authentication has experienced substantial growth, with revenues of $331.5 million in 2019 and an anticipated increase to $501.2 million by 2026.

Key players like Oracle, Okta, Onespan, NEC, Thales, Fujitsu, Yubico, Broadcom, Microsoft, and Google lead the industry. Industries such as healthcare, banking, gaming, insurance, and securities are among the largest users of OTP authentication.

Why Would You Use One-Time Passwords?

Using One-off passwords offers various advantages in terms of data security and transaction protection, such as the following:

• Ease of use. It is convenient, as users are familiar with SMS and don’t need additional devices or internet access to receive OTPs. A connected phone suffices.
• Cost-effective authentication. OTP offers an affordable authentication method compared to physical tokens or biometric verification. For SMS OTP, mass texting service providers can help minimize charges.
• Enhanced cybersecurity. Relying solely on a username and static password is risky. SMS-based OTP solutions add an extra layer of protection against hackers, as they cannot be reused.
• Secured user data. Single-use passwords can help recover compromised accounts and reset passwords. Unauthorized entry attempts alert users, who can quickly block their accounts if necessary.
• Reduced customer support expenses. Since customers can verify and recover accounts themselves using this security method, businesses can save on customer service costs.
• Increased customer trust. Integrating One-Time Passwords into your operations demonstrates a commitment to data security, fostering customer confidence, increased sales, and higher satisfaction.

Hardly any long-in functionality can go without the involvement of such an authentication measure as OTPs. 

Understanding How One-Time Passwords Work

OTPs are used to facilitate transactions or authenticate a user’s identity. They are utilized as a part of a secondary security layer.

When the user inputs their username and password an automatic request triggers verification with OTPs.  A unique 4 or 6-character code is then sent to the user via SMS or email. The randomly generated pass is nearly impossible to predict, and its time-sensitive nature means it must be used within a specified timeframe.

Types of One-Time Passwords

OTPs are primarily available in three forms: SMS, Voice, and Push Notification.

SMS-based 

The most prevalent type of single-use pass is sent as a text message to the user’s phone number upon a login attempt. The user then copies the code and enters it into the designated space to complete the process.

Voice-based 

OTPs can also be received through voice calls. The random code is audibly relayed to the user during the call. Voice OTP is accessible for visually impaired individuals and doesn’t save the message on the user’s device. It can serve as a backup to SMS-based OTPs.

Push Notifications

Push OTPs are delivered through a mobile app, and the user copies the code from the app to complete the transaction. While SMS-based One-Time Passwords work with all phones, push notifications require smartphones, as they rely on an app.

What Makes One-Time Passwords Secure?

Although not entirely foolproof, OTPs play a significant role in enhancing a company’s security, particularly when handling customer data and transactions. Some factors contribute to their safety:

Time Limit

They have a short lifespan, typically less than 5 minutes from generation. This constraint makes it difficult for cybercriminals to guess the random, patternless codes. Despite potential delays in receiving time-sensitive OTPs via SMS, they remain a valuable authentication method.

Single-Use Nature

An OTP is only valid for a single use, rendering it ineffective afterward. This ensures that unique codes are generated for every required authentication, keeping them secure as long as they aren’t intercepted beforehand.

Encryption

Single-time passwords use cryptographic security measures, such as hash functions used in the banking sector, to generate codes. The unpredictable number sequences and uncrackable algorithms defy attempts to identify patterns.

Multi-Factor Combination

The combination of processes and devices involved in generating such passes bolsters their security. This includes a personal device (something the user possesses), a username and password (something the user knows), and a non-reusable random code (OTP). Collectively, these elements contribute to the safety of SMS-based 2FA.

OTP Vulnerabilities and Security Concerns

While OTPs offer a significant degree of security, they are not entirely foolproof. Here, we discuss the reasons for their potential weaknesses:

SS7 Vulnerabilities

Signaling Service No. 7 (SS7) is the protocol enabling calls and messages to be transmitted across different networks. Developed in the 1970s with outdated models, SS7 lacks proper encryption for SMS and calls, allowing hackers to intercept SMS OTPs and calls with the right tools.

SIM Swap

Unauthorized SIM swaps pose a significant risk to OTP security. Hackers can perform a SIM swap to access the password intended for the user, calling a service provider and impersonating the SIM’s owner using stolen personal details.

Phishing

Phishing, a common attack on SMS-Based OTPs, involves criminals attempting to obtain sensitive information by posing as the victim. Malware planted on suspicious websites can read personal information, including passcodes stored on the phone.

Device Risks

Temporary passes rely on physical devices, such as phones, to function. If the phone or security token is lost or stolen, user data is at risk. After all, a third person can easily receive physical access to OTPs sent to the phone during an attempt of authentication.

Session Hijacking

In every online session on platforms ranging from social media to financial transactions, session cookies gather user data, such as login credentials, user behavior, and areas of interest. 

Cybercriminals can exploit this by forcefully gaining control of the session and acquiring passwords while the user is actively engaged. Account hijacking occurs when the server fails to flag the session cookie as secure, leaving it vulnerable to unauthorized access.

Network Problems

As OTPs are time-sensitive, delayed message delivery can frustrate users and affect SMS OTP reliability.

OTP and TOTP vs. Static Password

All three are authentication methods designed to protect user data, but they function differently.

• One-Time Password (OTP). These passwords used in OTP authentication is a single-use SMS password that remains valid until used.
• Time-Based One-Time Passwords (TOTP). These are also single-use but are only valid for a limited time, typically between 60 seconds and 5 minutes. Users must generate another TOTP for authentication if the previous one expires.
• Static passwords. These are conventional passcodes created by the user when opening an account. They remain the same until changed by the user. This type of authentication adds to mobile security the least, as hackers can use force or phishing to steal passwords. 

OTPs and TOTPs provide an additional layer of security to static passwords.

How are One-Time Passwords Created?

One-Time Passwords have become widely adopted across various industries for online security purposes. They can be generated in several ways, each with its unique advantages, challenges, and cost implications for organizations. Here are a few methods:

Security Tokens

These small, PIN-protected hardware devices generate authentication codes. Despite being convenient, security tokens are expensive and not every customer can afford them. Additionally, they are easily misplaced and require another device, like a smartphone or computer, to function.

Smart Cards

These cards contain embedded microchips that process OTPs. As they are card-based, information isn’t transmitted over public networks and cannot be intercepted. Smart cards can also store sensitive data on their chips.

Public Key Infrastructure (PKI)

PKI encompasses the processes, devices, and technologies used to secure and grant access to web systems. It authenticates user identities through secret keys connected to digital certificates.

Authentication Apps

Software applications like Google Authenticator and Microsoft Authenticator generate OTPs for user identity verification, using time in conjunction with random numbers.

In terms of authentication security, Single-Factor Authentication (SFA) and Two-Factor Authentication (2FA) are the most common methods. SFA requires just one set of credentials, like a username and static password, while 2FA involves an additional layer of authentication, such as an SMS OTP or flash call.

SMS-Based One-Time Password Alternatives

Several alternative two-factor authentication methods can replace SMS OTPs, including flash calls, biometric verification, WhatsApp, and hardware. They offer varying degrees of speed, cost-effectiveness, and security to cater to different organizational needs.

• Flash calls, characterized by a quick dropped call, instantly verify transactions or identities without any user interaction. This method is gaining popularity due to its efficiency and affordability.
• WhatsApp OTP offers enhanced encryption not present in SS7 protocols, making it a more secure and cost-effective option for businesses since it eliminates network fees.
• Biometric verification, a form of multi-factor authentication, relies on unique physical attributes of the user, such as fingerprints or retina scans, to confirm their identity. Although it provides a higher level of security, it comes with a higher cost as it requires smartphones or other advanced devices for implementation.

Conclusion

While SMS OTP is easy to use and popular, several risks make it vulnerable. That said, text messaging is still the most convenient option for customers. It also does not require a fortune to implement, especially for small businesses. Need to integrate SMS OTP to secure customer details or have any other work related to communication done flawlessly? Check out 2FA and other authentication solutions by the global communication platform — BSG. Consider us your trusted partner in the world of high-level interactions with customers.