Aspnetcore.docs: ISmsSender not defined anywhere - Doesn't explain how to register it with the UserManager for sending

[JohnGalt1717]

The above code works by magic as far as I can tell because ISmsSender, unlike IEmailSender, is not defined anywhere I can find, and you're not defining it above. As a result, even looking at the GitHub sample, I don't know how the 2fa process is actually knowing how to send an sms message for you.

You need to define exactly where ISmsSender comes from OR if it isn't a stock interface, how to get the UserManager to know about it and work. Otherwise this sample is useless.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 7af94e25-52f5-9f7e-33e2-67f223c7472c
• Version Independent ID: 344f2974-548c-9449-c892-5622063892fe
• Content: Two-factor authentication with SMS in ASP.NET Core
• Content Source: aspnetcore/security/authentication/2fa.md
• Product: aspnet-core
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[Rick-Anderson]

I'll address this in the next sprint.

[JohnGalt1717]

Thanks! In the mean time, where does ISmsSender live? I can't find ANYTHING about it anywhere. Yours is literally the only documentation I can find for 2fa in .NET core 2.1.

[Rick-Anderson]

Keep in mind we recommend you not use 2FA but rather QR code

ISmsSender is an interface the 2.0 templates generate. It's not in any MS library.

public interface ISmsSender
{
    Task SendSmsAsync(string number, string message);
}

[JohnGalt1717]

OK, well my question still isn't answered given that I don't want to be using QR codes. How does one register ISmsSender with the SignInManager so it knows how to send the message?

[Rick-Anderson]

@JohnGalt1717 Step through the template generated code to see how it works (and the sample).

[Rick-Anderson]

Thanks for contacting us.
We don’t have the resources to invest in this area, so we are closing the issue. Should your request generate enough 👍 responses, we’ll reconsider.

[JohnGalt1717]

At the very least fix the documentation so that it's obvious that this isn't an interface that's included and define the interface so people know what the heck is going on.

[knitero]

@JohnGalt1717, I agree with you 100%. Got the same problem too

[Bassist067]

Hey, any progress on that ISmsSender? How to inject this to UserManager?

[JohnGalt1717]

@Bassist067 There isn't any such thing. The documentation needs to be fixed to note this and give an example of what ISmsSender should look like and then note that you need to use a 3rd party implementation.

[andrewduffy77]

Surely SMS should have some priority

[Rick-Anderson]

SMS is not secure, that's why we recommend QR code

[andrewduffy77]

cheers Rick, so it's not secure if the attacker can get hold of the persons device OR is the vulnerability not dependent on that?

[Rick-Anderson]

SMS is susceptible to SIM Swap attacks

[gavinkilbride]

Hi Rick, I'm looking to use 2FA for our customers because we receive their email and phone number from a reliable source (their Mortgage Lender) and although that doesn't mitigate the SIM swap attack vector it does provide us with a convenient way to ensure 2FA is turned on by default. If we can have additional security by default then this raises the bar on security without compromising usability. I would prefer to use time based one time passwords however getting our users to download an additional application to do this does not align with a friction free onboarding path for our users and would require that we don't have 2FA enabled by default.

I guess all I'm really hoping is that you let us know if this is something that is likely to ever see the light of day or is it something that you think will fall out of favour completely and ever be developed/completed as we will have to make alternate plans.

[Rick-Anderson]

@gavinkilbride you're still free to use SMS/2FA and like you say it's pretty simple.

[andrewduffy77]

@Rick-Anderson so you're saying I can implement a custom 2fa provider in order to achieve SMS 2FA in Microsoft.AspNetCore.Identity 3?

How do I implement / wire that up? I can't find this anywhere?

Cheers

[Rick-Anderson]

@blowdart what's our guidance for SMS 2FA for ASP.NET Core 3.0. @gavinkilbride makes what seems to me a reasonable argument for it (Friction free 2FA).

[blowdart]

Out guidance is the same as NIST, no-one should be doing this any more. The previous approach in 2.0 should work, but we're not going to document it.

[kigold]

Hello, I have been all over the internet trying to implement this SMS 2FA thing, similar to the other requests, I do not want to introduce extra complication on the user part, so QR code is not an option, PLEASE, any information that would guide me on how to implement this would be greatly appreciated. Thanks

[Rick-Anderson]

https://docs.microsoft.com/en-us/aspnet/core/security/authentication/2fa?view=aspnetcore-1.1 shows how to do it. Generate a 1.1 project and copy the code to a 3.1 project.

[RyanDansie]

password are also insecure and vulnerable to all kinds of attacks but they are still used everywhere. a combination of password and SMS would be a step up from password alone. The QR code cant be a serious suggestion. Ive just checked on live.com and im able to setup sms 2 step auth on my microsoft account. It also let me recover my account with my email address, which is so much worse than sms. In this industry its accepted that no single auth method is perfect

[KarliHuber]

"This tutorial shows how to set up two-factor authentication (2FA) using SMS." Please remove this sentence. After creating a ASPSMS Account, asking for a test credits at ASPSMS , installing ASPSMS Package, modifing my code, I'm google for "ISmsSender", to read this issue...
Please supersede "This tutorial shows how to set up two-factor authentication (2FA) using SMS." with " Two-factor authentication (2FA) using SMS is not supported in Core 3.1". Many thanks!

[Rick-Anderson]

@KarliHuber you're free to use the 1.x and 2.x generated code for SMS..

[RenegadeMaster]

Hi guys. I really believe this needs to be addressed. Spent so long puzzling why I could not find this declaration anywhere. At the very least amend the documentation or provide the interface in Microsoft.AspNetCore.Identity.UI.Services. Should be super easy to do with such a lightweight interface?