Implementing two-factor authentication with SMS

The technology is simple; the details decide whether it is both secure and usable.

The code

Six digits is enough. Generate with a real random source, not with a timestamp. Store it encrypted or as a hash, never in readable form.

The validity period

A few minutes. Longer raises the risk without helping the user: anyone who does not enter it within five minutes simply requests a new one.

Limit attempts

Both how often a code may be entered and how many codes may be requested. Without that second limit, somebody can have messages sent at your expense.

Put context in it

State what the code is for. Anyone who did not request one then knows immediately something is wrong.

Think about people who lose access

A lost device or a changed number must not mean permanent exclusion. Provide a recovery route, and do not make it weaker than the security itself.