Phone number login and verification for mobile apps

Question

Can someone shed some light on the security behind mobile phone logins on mobile apps?

Uber and Lyft ask the user to login using their mobile phone, I'm assuming because it is a more unique identifier than email, and then they text you a verification code to enter. Once the code is entered and the mobile number is verified, you are able to login. They also never log you out unless you manually log out.

It seems as though this has taken the idea of two-factor authentication (something you know and something you have) and basically dropped the "something you know" portion of it (a password). Is this true? If someone were to steal your phone they could essentially jump into the Uber or Lyft app and use it as much as they want without ever having to verify (of course until you catch the charges on your credit card).

Is there an extra layer of security I am missing? It may not matter as much for an app like Uber or Lyft, but what about for a medical app that must be HIPAA-compliant? I found 98point6 the other day, and they seem to use the same mobile phone login approach. However, they log you out after 15 minutes of inactivity (HIPAA regulations) and so you must enter your phone number and the texted verification code every time to use the app.

Apologies for the long-winded post, but I just want to understand the benefits of a login approach like this (is it just so that you never have to enter a password?) and further, is there an extra layer of security I am missing that allows for even HIPAA-compliant apps to take this approach?

Thanks in advance!

Answer 1

The whole idea of two-step authentication is based on the fact that device that is used for generating or receiving the code is physically owned by the person who tries to login. I.e. somebody else could suggest your password (or spy on you, etc) but hardly have access to your phone/tablet/special device/etc. These codes are one time only and expire fast, so somebody else could not use an old code to login even if she got one.

The weak thing about codes being send via SMS is that these SMSes can be intercepted, or your phone number can even be redirected. Here in Russia it happened several times (and probably more) with public people who claimed that their phone number was redirected to someone's else number and then used for receiving these one-time 2-step auth codes, so basically it is more secure to use an app for code generation (Google, for example, uses such an app), it is also more secure because SMSes are usually shown at lock screen so bad person shouldn't even touch your phone to get the code.

So, most companies use two-step authentication in addition to passwords (so why it is called two-step: password + code) and that (in case if your password is strong enough and you change it from time to time) may somehow guarantee that it will be more or less hard to hack into your account.

Companies like Uber and Lyft use phone number confirmations not only for authentication bu also for other things. I guess it's used not only to protect your account but also to make sure that you is you, because: * They use ratings for both drivers and riders so they need to keep this rating bound to a one person * They have promotional rides that need to be used only once then you register in the service * They also need to be sure that driver can contact you so they need to check that by sending something to your phone and you respond

Actually, as far as I know both these companies still have plain old passwords in addition to SMS verification (at least Uber as I check it right now), so they actually secures your data via password and use your phone mostly to identify you first time you installs their app.