tech
Millions of people imperiled through sign-in links sent by SMS
Even well-known services with millions of users are exposing sensitive data.
TL;DR
- Websites using SMS for user authentication are creating privacy risks for millions.
- Authentication links sent via SMS can be easily guessed or enumerated by scammers.
- Researchers were able to access other users' accounts and view personal details, including partially completed insurance applications.
- Many authentication links remain accessible for years after being sent.
- The attacks are easy to execute at scale using consumer-grade hardware and basic web security knowledge.
- SMS messages are sent unencrypted, and past discoveries have revealed public databases of sent texts containing authentication links and private details.
- The practice continues despite known security risks, as it lowers perceived friction for customers and avoids the need to store passwords.
- More secure alternatives include time-limited 'magic links' sent via email with cryptographically secure tokens, or multi-factor authentication.
- Only a small fraction of contacted service providers have fixed the identified security failures.
- The burden of fixing these weak authentication processes lies with service providers, not solely on users.