OWASPASVS 5.0 requirement
ASVS-V6.6.1 Authentication mechanisms using the public switched telephone network (pstn) to deliver one-time passwords (otps) via phone or sms are…
- Standard
- OWASP ASVS 5.0
- Chapter
- V6 Authentication
- Section
- V6.6 Out-of-Band authentication mechanisms
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that authentication mechanisms using the Public Switched Telephone Network (PSTN) to deliver One-time Passwords (OTPs) via phone or SMS are offered only when the phone number has previously been validated, alternate stronger methods (such as Time based One-time Passwords) are also offered, and the service provides information on their security risks to users. For L3 applications, phone and SMS must not be available as options.