无密码SMS身份验证 - 令牌到期＆amp;安全
我希望为当前正在生产的移动应用程序实现无密码解决方案。目的是通过删除使用密码来使用户的登录过程更加顺畅。由于该应用程序仅是移动设备，并且已经将用户的电话号码用作用户名，因此我觉得自己是使用Twilio来生成OTP（一次性password）登录的解决方案。
尽管如此，今天当用户登录时，身份验证令牌没有到期日期（他永远登录）。我想知道是否使用OTP生成如此无限（或很长的持久）auth代币将被视为安全问题。是否有一些最好的做法需要考虑到刷新令牌或其他...
要清楚我的问题是：
将OTP与SMS一起使用被认为是一种很好的做法，以保持始终登录应用程序？您是否看到我的推理中有任何缺陷？
谢谢 ！
I am looking to implement a passwordless solution for a mobile app currently in production. The aim is to make the login process smoother for the users by removing the use of a password. Since the app is mobile only and that the phone number of the users is already used as a username I feel like a solution using Twilio to generate an OTP (one-time-password) to login is a good alternative.
Nonetheless today when a user logs in, the authentication token has no expiration date (he stay logged in forever). I would like to know if using an OTP to generate such unlimited (or very long lasting) auth token would be considered as a security issue. Is there some best practice to take into consideration like refresh tokens or other ...
To be clear my question is:
Is using OTP with SMS considered as a good practice to stay always logged in to an app ? And do you see any flaw in my reasoning ?
Thank you !
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
look https://bere.al/en/en ，Bereal使用此系统来验证用户。
当您更改/丢失SIM卡时，我们会有问题。
但是我看不到任何安全问题。
Look https://bere.al/en , Bereal use this system to auth users.
We have probleme when you change/lose you sim card.
But I don't see any security problem.