Q: What is the end of SMS authentication?
A: SMS authentication verifies user identity by sending a one-time code via text message to a user’s mobile phone number. With the rise of potential security risks, many financial websites, applications, and phone apps are phasing out SMS-based authentication and transitioning to authenticator apps that reside on user devices and smartphones.
Q: What are some of the potential security risks associated with SMS authentication?
A: Attackers have a variety of means of intercepting SMS text messages, thus defeating this type of authentication. This increases the risk of interception and misuse of the codes in question and decreases the security of the user’s account with the financial institution.
Q: What is an authenticator app?
A: An authenticator app is an application that resides in encrypted storage on the user’s device and, when prompted, provides a one-time password (“OTP”) just like the code sent in the text message. The difference is, through a variety of cryptographic techniques, once the application is set up and the settings configured, it doesn’t need to communicate with the financial platform and thus is significantly more difficult for attackers to compromise.
Q: What are the steps for organizations to switch from SMS authentication to authenticator apps?
A: Here is a quick overview of what is needed:
1. Research and decide on an authenticator app that meets your organization’s needs. Most of the time, users can select their own apps, and the firm selects the libraries needed to support them. Open source and commercial solutions abound in this space now.
2. Update user accounts in each application and authentication point with the new authentication protocol and provide instructions for downloading and setting up the authenticator app.
3. Educate users on using the authenticator app, including generating one-time passwords (OTPs), scanning QR codes, etc.
4. Monitor user feedback and usage data over time to ensure a successful switch from SMS authentication to an authenticator app.
PS – Need a process for cataloging all of your authentication points? Here you go.