Overview#Passwordless SMS Authentication allows Application Development Teams to provide Authentication without the need to remember a password.
Passwordless SMS Authentication the user is bound to the connection using an Identity Provider (IDP). Since you can't force users to use the same mobile phone number or email address every time they authenticate, users MAY end up with multiple user profiles in the IDP DataStore but you may be able to perform Identity Correlation.
Passwordless SMS Authentication Benefits#The benefits of enabling Passwordless SMS Authentications include:
- Improved User Experience, particularly on mobile applications, because users only need an Email Address or mobile Phone Number to Registration, and the credential used for authentication is automatically validated after sign-up.
- Enhanced security because users avoid Password Reuse
- Less effort for you because you will not need to implement a Password Recovery procedure.
Passwordless SMS Authentication Implementation Issues#These are the primary Implementation Issues Ldapwiki is aware of:
- infrastructure. Implementation need to use a Cloud Service Provider or Third-party service to manage the SMS with Mobile Network Operators. Auth0, Twilio, okta, and AWS Cognito are just a few Service Providers to get started.
- the additional cost of SMS, especially global SMS and variable pricing. Even though these are one-time passcodes, the cost per SMS message is more expensive than the FREE options of federating Social Identity Providers.
- app will most likely be running on Mobile Devices that do not have a Phone Number or cellular plan such as an iPad Wi-Fi edition. In this case, the user would need to have their Mobile Device nearby when they wanted to authenticate on a non-cellular device. Most of the time this is not a problem, however, in some families, children have a wifi iPad and no mobile SMS capable Mobile Device. So, in this case, the developer would need to offer additional Authentication Factors such as a basic username/password. Not too radical but does add an additional barrier and this is why most mobile developers will offer several ways for users to authenticate.
Passwordless SMS Authentication Privacy Considerations#Passwordless SMS Authentication supports Privacy Enhancing Technologies and supports Law of Minimal Disclosure For A Constrained Use where the Relying Party Application has no knowledge of the user other than their Mobile Device Phone Number or Email Address
Passwordless SMS Authentication Security Considerations#The obvious risk here is if someone gains access to the physical Mobile Device and bypasses the phone’s security to read SMS messages.
Some others are paranoid over a possible SIM Swap.