I would like to be able to setup twilio sms TFA on the behalf of other users. So basically I want to be able to skip the initial verification SMS that establishes TFA on their account.
I don't think this has any security downfalls since they'd essentially do the same thing on first login.
The main problem is if the supplied phone number is wrong. However, when setting up TFA for another user using their mobile number, this setup verification step doesn't help this since I don't have access to the user's mobile phone. Furthermore I don't have access to their phone in order to get the code to complete the verification setup step, which makes it not very useful in this particular context.
Comments