tru.ID versus Authenticator Apps

Authenticator Apps

tru.ID

Why does it matter?

Security factor

App-generated codes are a

possession factor

and are harder to steal, but require the user to download extra software.

tru.ID is a much stronger

possession factor

that proves possession of a SIM card which has the expected number.

Both tru.ID and authenticator apps are proof of possession, but apps are disconnected from the underlying identity and exclude some of your users.

Possession-factor authentication is much stronger than passwords alone. However, not all users are willing or able to download a separate app for authentication. This also means they can only be used as a second factor for verifying an identity.

Accompanying identity or credential

A mobile device

Mobile phone number

Authenticator apps are not associated with any identity, and can only be used as a second factor. They prove possession of a device authorised by a user, not an identity.

Risk of compromise

Low

App-generated codes are usually time-sensitive, making them difficult to steal. tru.ID authentication makes faking possession is virtually impossible.

User effort required

High

Minimal

Any friction that disrupts the flow of signing up (or other user actions) causes users to drop off.

Authenticator apps require the user to have a smartphone with storage, and to be willing to download an external app. This excludes many users who are either unable to get the app, unwilling to take the time and effort, or don’t understand the technology.

Even if the user makes the effort to download and sign up for external software, they still must switch to a different app to retrieve the code every time.

In addition, because the codes are time-sensitive and the process requires back-and-forth between two services, users inevitably mistype codes. All in all, it’s a lengthy and frustrating experience.

Verification with tru.ID is strikingly different. Totally in-band, near-instant, and invisible, it feels like magic to the user.

Data Collected

None

Changing privacy laws mean collecting user data is legally complex – and anything you store is at risk of being breached.

Requires managing a user database?

Yes

Managing a user database is not only costly, but puts you at risk of data breaches.

Susceptible to Man-in-the-middle attacks?

Yes

MITM (man-in-the-middle) attacks occur when an attacker intercepts a private communication.

Although their short time window helps mitigate this, authenticator apps still generate a code which can be intercepted by bad actors who have infiltrated a device with malware or through phishing websites.

Authentication with tru.ID is passwordless, requires no user action, and doesn’t show codes to the user, leaving no room for MITM interception.

Susceptible to SIM Swaps?

Yes

SIM swap fraudsters impersonate a victim to receive a new SIM card which all calls and messages for the victim's number are then routed to.

Any two-factor authentication codes that are sent to the number find their way to the fraudster instead. They can then reset both passwords and associated phone numbers for the victim's accounts, thus allowing them to steal the victim’s identity and money.

Most authenticator apps verify a phone number through alternate means as a fallback for when a user may be switching devices or without access to the authenticator for any reason. The risk of such a fraud is not mitigated by using Authenticator apps.
‍
tru.ID is able to check whether a SIM has been changed, so you can prevent access or trigger an additional step-up security challenge in response.

Compare tru.ID verification to authenticator apps