Study Finds SMS Sign-In Links Expose Users to Account and Data Risks
Summary
A study found weakly secured SMS sign-in links at 701 endpoints serving 177 services, exposing personal data and enabling account access through guessable tokens. Its limited sample likely understates the scope; only seven of 150 contacted providers had fixed issues.
Key points
- Researchers collected 322,949 unique SMS-delivered URLs from more than 33 million texts sent to over 30,000 phone numbers, using public SMS gateways as a limited view into the practice.
- The study linked 701 endpoints to 177 services and found links that exposed sensitive personal information, including Social Security numbers, dates of birth, bank account numbers, and credit scores.
- At 125 endpoints, low-entropy tokens allowed mass enumeration of valid links; researchers reported accessing other users’ accounts by changing tokens.
- Some links remained usable for years, and in some cases clicking a link was sufficient to access or modify user data.
- The researchers said their findings likely undercount the problem because their method could not measure the practice’s full scale.
- Recommended safeguards include short-lived, single-use links with cryptographically secure tokens, rate-limited login attempts, and an additional factor stronger than low-entropy personal details.
- Of 150 affected service providers researchers contacted, 18 responded and seven had fixed the reported failure.
Article Details
- Publisher
- Ars Technica
- Scope
- Security and privacy risks from SMS-delivered authentication links observed through public SMS gateways; the researchers said their view was limited and did not measure the practice's true scale.
- Sample Size
- 322,949 unique SMS-delivered URLs extracted from over 33 million texts sent to more than 30,000 phone numbers.
- Key Statistics
- The researchers found 701 endpoints sending messages on behalf of 177 services that exposed critical personally identifiable information.
- Of those 701 services, 125 allowed mass enumeration of valid URLs due to low-entropy tokens.
- The researchers contacted 150 affected service providers; 18 responded and seven had fixed the failure.
- The dataset contained 322,949 unique URLs extracted from over 33 million texts sent to more than 30,000 phone numbers.
- Recommendations
- Service providers should use short-lived authentication links with cryptographically secure tokens and expire them after the first login.
- Add a second authentication factor; do not rely on low-entropy details such as birthdates or ZIP codes as that factor.
- Rate-limit login attempts to prevent repeated guesses.
- Users who identify these issues can report them to the service provider or remove their data until the issue is fixed.