5

In order to be more secure we're looking into account verification. The two options are:

  1. Email address verification (Asking the user to click a link in an email sent to their account to verify the account)
  2. SMS verification (Asking the user to enter 4 numbers sent to their mobile into a form on the screen)

For me, I much prefer the SMS approach. Here's why:

  • I don't have to leave the interface.
  • It's quicker than opening/authenticating your email client.
  • From a security perspective, it's much harder to create a 'fake' phone number than it is a 'fake' email account.
  • If I'm using a laptop, when it's email verification, I usually use my phone to open the email and click the link. Then I have to go back to the laptop and refresh or navigate somewhere.

So does using SMS verification without email verification make sense from both a usability and security perspective?

Are there any valid reasons why a user couldn't receive an SMS message in order to complete their registration?

  • I would definitely ask/search the security perspective over on security.stackexchange.com, while I agree with your reasoning I feel like I've heard email being more secure than SMS. – DasBeasto Jan 8 '18 at 17:51
  • 1
    I am partial to email or at least give the user the option as I still know people who live in non-cell zones. – Carrie Jan 8 '18 at 18:10
6

A lot of people use their phone to sign up for services. Having to go to your messages to copy the code and then drop it into the interface can be slower than just going into your email client and clicking on the provided link. I don't think it's fair to assume SMS is quicker, as some people also don't carry a smartphone on themselves at all times (especially older folk).

Ideally, you'll want to verify both email and phone number if you have a sensitive service. Both for security of the account and data collection quality. The email verification aspect is the first barrier to prevent fake accounts, prevent people from using other people's email addresses, enable a password/login retrieval system, and more certainty that the user will receive any communication you send through mail. As a business you'd want good quality data, and this kind of validation ensures the email address is valid. You do have no way of knowing if the email was just a throwaway...

Generally you'll need a good reason to ask someone to verify a number, as its a known conversion killer and can be part of privacy laws. Depending on where you're at, you may have to deal with the General Data Protection Regulation or equivalent soon. Asking only necessary data becomes more relevant then. Email verification only is more 'justified' in that case, because you can tie it to login retrieval. It's kind of weighing the perceived security benefit with the hassle of all the verifying.

4

It's best to offer both email and SMS sign-up -- some users prefer the control that an email address provides, such as in cases of householding (when a couple or family signs up for an account, and wants a shared space for communications and transactional information.) SMS is very convenient and preferred by the mobile-first generation.

1

I would share my experience with lots of banking, wallet, Social apps which are actually asking for verification via an SMS. Even Apple is sending a verification SMS to its servers before activating iMessage and FaceTime only after you would be able to use 'Handoff' functionality on your phone and Mac.

Even I have observed SMS penetration even when calls are not able to connect.

Therefore to your preference for SMS, I would simply add my +1

1

"Are there any valid reasons why a user couldn't receive an SMS message in order to complete their registration?"

Sure ... Consider the following scenarios:

  • Why should I give you my real cell phone # when I can use the throwaway email address I use for all such service sign ups? Is my phone # critical to the service you provide? If not, you don't get it from me.

  • I'm over age ## so I still use a landline phone.

  • I'm blind and use a screen reader for my computer, but haven't figured out how to get Siri to read me my texts yet.

  • I registered w/my office landline # because that's where I'll use the service & they paid for it.

  • I'm overseas w/o a working cell phone, but I have Internet access. Any business travelers or vacationers who might use your service?

  • I live in a rural area w/o good cell reception, but I have a landline phone & Internet access.

  • I work in an underground bunker or vault. Any military/gov't, banking, or other such industry employees using your service where no cell phones are allowed?

  • My awful phone provider still charges $10/mo for texts so I don't pay for them out of spite

  • I can't afford or don't want to spend $50+/mo for a cell phone, but I happily use free/public wi-fi to do all sorts of things, including registering for your service. (Visit your local library, career center, or starving grad student for examples).

BTW, people fake phone #s all the time now too - don't you get those scam calls from a number that looks almost like yours but isn't?

Offering both options for registration seems to still be preferable. Let people register via SMS if it's a possibility for them & they're ok giving your their real phone # , but offer email registration/codes as well for these & any number of similar reasons.

You could still offer opt-in SMS-based 2-factor authentication for added security while using the service, but don't make use of the service contingent on that without valid reasons.

  • It's also worth noting that our UX department did some international studies with less developed countries. We found that SMS (while they did have cell service) was extremely unreliable, it was very common that the code just never came. – Casey Robinson Jun 7 '18 at 17:13
0

Two-factor authentication (2FA) with the use of text messages is a great way to automated registrations and stop users from having many accounts used for various activities.

Remember that user validation during registration goes well with signing-in process. There are a lot of articles about specific aspects of 2FA if you would like to get more information on this topic. The great thing about being able to send user a text message is that with it does not matter what the password is, as even if attacker can "guess" the password, the code sent to users mobile device will remain unknown.

0

SMS is a convenient but not secure way to deliver OTPs. National Institute of Standards and Technology (NIST) issued new proposed digital authentication guidelines urging organizations to use other forms of two-factor authentication. Why don’t you consider hardware or software tokens? For example, Google Authenticator. It’s convenient and reliable. Or you can use a hardware alternative to Google Authenticator. Protectimus Solutions, the company where I work, offers Protectimus Slim NFC. It has a form of standard banking card and doesn’t require any internet or network connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.