3

Upon registering as a user to an app, user will need to enter his phone number to recieve a SMS with a code, which he needs to enter, to continue with registration.

On the next screen, the user is also required to enter a password which may be used if he logs out of the app.

My question is, Do we still require passwords although SMS can be used to log in ? In other words, isn't SMS enough to complete a registration ? do we still need the password ?

Improve this question
3
  • 1
    how long is the code valid? Also how do I login later, will I be still able to use the code?
    – Mervin
    Commented Jan 1, 2015 at 13:36
  • I think the code is good for a few minutes. After X minutes had passed, a new code will be sent by your request
    – AsafBO
    Commented Jan 3, 2015 at 20:30
  • I think one reason with Password is to prevent SMS abuse, like you know someone's phone number, without Password you can login his account and system will sent out lots of unnecessary SMS
    – Yami Odymel
    Commented May 3 at 6:58

3 Answers 3

Reset to default
2

If you're making a mobile only application. Then you can do away with passwords and keep the phone number as the only way to authenticate the user. Facebook acquired whatsapp does this and has always been using this method. Only one session of the user stays at any given time. If the user changes mobile phones but has the same phone number, then on re-activation the account on the new phone, whatsapp automatically deactivates the old client application on the old phone.

Password authentication is one that spoils the user experience. But it's a good way of authenticating so it's lived on for so long. Twitter recently launched digits a so-called password-replacement developer tool. It follows a similar approach Whatsapp uses to authenticate. You can use it.

Phone number authentication is rather a new concept, but it's catching up and is proven to work.

I mentioned mobile only application because I'm not sure about how this concept will work on multiple clients and multiple sessions.

Improve this answer
0

I would say yes, you still need a password as a fallback option. Because phone numbers are prone to getting lost, being deactivated, getting terminated, or owners of the phone numbers might change (especially if the phone number is a prepaid one) etc.

Improve this answer
2
  • what if the user forgets the password and the number gets deactivated? how can the user recover his credentials in that case
    – ashu
    Commented Jan 2, 2015 at 7:22
  • you could encourage users to add their email too for extra security for resetting the password. but it should be done non-intrusively and definitely not all of them at once during the registration process
    – Ades
    Commented Jan 5, 2015 at 4:41
0

I think SMS and password cover different use cases:

  • The SMS is sent during registration (sign-up) to validate the entered phone number.

  • The password is used after registration during log-in to validate the user.

I would not want to use an app that sends me an SMS token every time I want to log into the app. That would either force me onto an SMS-flatrate, or (more likely) would force the app from my smartphone.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.