Network-based authentication versus app-based biometrics

Network-based authentication versus app-based biometrics

A product team choosing a second factor in 2026 has three mature options: SMS one-time password, app-based authenticator (push approvals, TOTP codes, biometric prompts inside a custom application), and network-based silent authentication. None of them is the correct answer for every application. All three have measured failure modes in the peer-reviewed literature, and the right deployment usually uses two of them with a defined fallback order.

This post describes what each factor actually proves, how the documented attack surfaces differ, and when the app-based route beats the network-based route.

What each factor proves

SMS one-time password proves that a message was delivered to an MSISDN. It does not prove the MSISDN is still bound to the claimed user's SIM, and it does not prove the device receiving the message belongs to the user.

App-based authenticator proves that a specific installed application instance holds a key. The forms vary: a push notification signed by that key, a TOTP seed bound to that install, a device biometric that unlocks a secret stored locally. The trust is in the enrollment step where the key was provisioned and in the subsequent binding of that key to the user's account.

Network-based silent authentication proves that the device currently on a cellular data session is registered to a specific MSISDN at the operator's signalling layer. The MSISDN binding is established at SIM issuance by the operator's KYC process and is recomputed every time the device performs the Authentication and Key Agreement exchange at network attach.

These three proofs are orthogonal. Each rests on a different enrollment and a different key material. Any serious comparison has to describe the differences on their own terms rather than treat them as interchangeable.

Failure surfaces, measured

The literature has reasonable empirical data on two of the three factors.

Push-based app authenticator: a 65-participant user study of push-compare-and-confirm 2FA measured a true-positive rate above 95 percent in benign scenarios, where users correctly confirm legitimate requests almost every time. Under concurrent-attack conditions, where the attacker triggers a fraudulent login at the same moment the user is expecting a legitimate one, attack-detection rate drops to approximately 50 percent. The weakness is in the user as the decision point rather than in the cryptography. Users under time pressure often approve the attacker's prompt thinking it is their own. "Just Confirm" style push, where the user taps a single approve button without matching a code, performs worse than compare-and-confirm under the same attack conditions, and the industry drift toward code-matching prompts is the direct consequence of this measurement.

SMS OTP: the failure surface is the SMS delivery channel itself. SS7 interception, Diameter interception, and Android malware with READ_SMS permission have all been documented as working attacks. The summary from the literature is that SMS OTP is usable in practice because the attacker population capable of SS7 or Diameter exploitation is small, but the rerouting surface exists and is known.

Network-based silent auth: the failure surface is coverage rather than attack, with one caveat. Coverage failures are the majority case. A device not on cellular data, a subscriber on a non-supporting operator, or a lapsed IMS registration will all produce no silent-auth verdict. The attack surface that does exist is in client-side token handling and in runtime-environment attestation, demonstrated in an impersonation attack against one-tap authentication across three Chinese MNOs. The attack is real and the mitigation is an implementation-level audit rather than a design change.

The enrollment step is where they diverge

A useful frame for choosing between factors is which enrollment event each depends on.

App-based authenticators depend on the moment the user installed the app and completed the initial bind. The bind is typically an OTP or email-link confirmation that the device is the user's. If that first step was compromised, every subsequent push or biometric prompt inherits the compromise. Implementations that include a TOTP shared seed also carry the seed-storage problem into the threat model.

Network-based silent auth depends on the SIM issuance event. At that moment the operator (Tensormobile or a federating operator) has performed whatever KYC the local regulator demands. In the EU framework, the relevant trust levels are the eIDAS Low / Substantial / High scale, and a carrier that did document KYC at SIM issuance maps to Substantial. In markets where document KYC fails for a meaningful share of the population, the SIM-issuance step often still succeeded because the user had a utility bill, a mobile-money account history, or an employer reference the operator accepted. The enrollment is load-bearing, and it happened before the authentication vendor was even in the picture.

SMS OTP depends on the same SIM issuance, but the proof it exposes is weaker because the SMS channel carries the credential outside the secure envelope.

When each factor wins

Network-based silent authentication is not universally superior, and there are deployments where app-based biometric authentication is the right answer.

The clearest case for app-based is a single-purpose application with high account value, a small and verified user base, and a need to authenticate on Wi-Fi-only tablets or smartphones in power-saving mode. The silent-auth coverage constraint (cellular data, active IMS registration, supported operator) cuts hard in that deployment, and the app-based route sidesteps the constraint by binding to the device rather than the network. Corporate banking on a managed device is the canonical example.

A second case is applications where user enrollment is tightly controlled and the relying party can verify the device at a provisioning step, such as an employer-issued device enrolled in an MDM. The app-based authenticator inherits the MDM trust chain. Silent auth does not add to it.

A third case is markets where the home operator does not expose silent-auth APIs. CAMARA Number Verification is expanding, but coverage at the time of writing is uneven by country and by operator. If the target user base is concentrated on an operator that does not participate, the silent-auth path is not available and the relying party needs to choose between SMS OTP and an app-based authenticator. The push-versus-SMS decision at that point turns on the measured 50 percent attack-detection rate of push under concurrent attacks against the rerouting surface of SMS. Neither is ideal. The choice depends on the attacker model.

The clearest case for silent auth is the consumer-onboarding flow where the user is a first-time install and there is no prior app-bound key to trust. At that moment the app-based authenticator cannot help, since there is no enrollment event to chain against, and SMS OTP is the usual fallback. Silent auth replaces that SMS OTP with a network-layer confirmation that the device making the request is the device holding the SIM. The friction drops and the rerouting surface is removed from the flow.

A second case is mobile-money and consumer fintech at scale, where the user base includes a meaningful share of devices running older OS versions, devices without a biometric sensor, and users who routinely switch between devices. App-based authenticators work poorly across these populations because the enrollment-to-device binding becomes the failure mode. A user who got a new phone has to re-enroll every factor, and the enrollment path itself is often SMS-mediated anyway.

A third case is any flow where the cost of friction is not just UX but commercial. Published 2FA-adoption research consistently finds that user hesitation at enrollment is the primary reason 2FA coverage stays low, and low 2FA coverage translates directly to higher account-takeover rates. A zero-friction second factor that works on the first attempt is more effective at moving adoption curves than one that asks the user to install an app and complete a QR-code enrollment.

Comparing the two factors

Neither "silent auth is the future" nor "app-based is more secure" is a defensible blanket claim. The comparison comes down to four specific dimensions.

Coverage: an app-based authenticator is device-bound and works anywhere the device does. Silent auth requires cellular data, a supported operator, and an active IMS registration. SMS OTP requires only basic mobile coverage.

Attack resistance to remote attackers: silent auth removes the SMS rerouting surface and the push-fatigue surface, but carries a client-side token-handling surface that requires an implementation audit. App-based push carries a user-decision surface with measured 50 percent attack-detection under concurrency. SMS OTP carries the well-documented signalling-layer and endpoint surfaces.

Enrollment assumptions: app-based inherits the initial-install bind. Silent auth inherits the SIM-issuance KYC. SMS OTP inherits the SIM-issuance KYC but exposes the credential over SMS.

Recovery semantics: app-based requires a re-enrollment flow that is often SMS-mediated or recovery-code-mediated. Silent auth requires the user to be on the SIM. SMS OTP requires the user to hold the SIM.

How TensorAuth ships silent auth

TensorAuth's silent-auth product runs on the Tensormobile home network and federates via CAMARA Number Verification where partners participate. Per-region coverage data and a fall-through rate by operator are published so integrators can size their fallback. Integrators who need an app-based authenticator on top of silent auth can run one. TensorAuth does not ship an app authenticator SDK because that market is already well served, and adding one would not add new value.

What TensorAuth does expose, and what matters for the product decision, is the specific claim: silent auth resolves the factor at the signalling layer, using the enrollment that has already happened at SIM issuance, without putting the credential on the SMS channel. That is the specific improvement over SMS OTP. It is not an improvement over an app-based authenticator that the relying party has already enrolled. It is a different factor with a different enrollment, orthogonal to that one, usable as a primary or a secondary depending on the flow.

Compared side by side, the two factors are complements more than competitors. Silent auth handles the cases where there is no prior app-bound key and the friction cost matters. App-based authenticators handle the cases where the device has been provisioned and the cellular data path is unreliable. A relying party with both has more coverage of the failure surface than one with either alone.