无密码 SMS 身份验证 - 令牌过期和安全

Question

I am looking to implement a passwordless solution for a mobile app currently in production. The aim is to make the login process smoother for the users by removing the use of a password. Since the app is mobile only and that the phone number of the users is already used as a username I feel like a solution using Twilio to generate an OTP (one-time-password) to login is a good alternative.

N.netheless today when a user logs in, the authentication token has no expiration date (he stay logged in forever). I would like to know if using an OTP to generate such unlimited (or very long lasting) auth token would be considered as a security issue. Is there some best practice to take into consideration like refresh tokens or other...

To be clear my question is:

Is using OTP with SMS considered as a good practice to stay always logged in to an app? And do you see any flaw in my reasoning?

Thank you !

Answer 1

Look https://bere.al/en , Bereal use this system to auth users. We have probleme when you change/lose you sim card. But I don't see any security problem.