title: API authentication with mobile app (by SMS)
body: <p>We are currently tasked with implementing a (preferably simple) authentication system for a mobile application communication with a RESTful API. The backend has user-specific data, identified by the user's phone number. I am trying to understand more about security in general, the different methods there are and why they work the way they work.</p>
  
  <p>I thought of a simple authentication system:</p>
  
  <ul>
  <li>The client sends a verification request to the api which includes their phone number and a generated guid.</li>
  <li>The server sends an SMS message to the phone number with a verification code.</li>
  <li>The client verifies their device by sending their unique guid, phone number and verification code.</li>
  <li>The server responds with some kind of access token which the client can use for further requests.</li>
  </ul>
  
  <p>I have the following questions:</p>
  
  <p>Are there any major flaws in this approach?
  Assuming we use HTTPS, is it secure enough to send the data otherwise unencrypted?
  Can access tokens be stored on mobile devices safely so that only our app can read them?
  Anything else we haven't thought of?</p>
  
  <p>We already figured that when the mobile phone is stolen or otherwise compromised, the data is no longer secure, but that is a risk that is hard to overcome. Access tokens could be valid temporarily to minimize this risk.</p>
  
  <p>I am assuming this approach is way to simple and there is a huge flaw somewhere :) Can you enlighten me?</p>