Hacker News new | ask | show | jobs
by warmstart 1225 days ago
By Phone OTP I mean the following Registration/Authentication flow : To Register, user must enter phone number, user is then sent a 6 digit code via sms to the given phone number, user then must enter the code to register. To Login, it's the same flow.

By "Refuse" I mean - User has full ability to go through the flow but chooses not to for whatever reason (eg. doesn't want to share their phone number)

1 comments

You are aware that this isn't a secure method for MFA, right? Issues of people's willingness to provide phone numbers aside, I would encourage you to look at other options if security is your goal.
Yes; thank you for bringing that up. Sim Swapping would also be a concern.