title: Two Factor Authentication System
body: <p>I'm trying to design a two factor authentication system (on PHP) using SMS as the second auth method. This is for a test project thus can anyone help me to design this service?</p>
  
  <p>This will be an web based system and below is what i have done so far.</p>
  
  <ol>
  <li><p>Once the client enters the Username and Password the website will send a secure HTTP request to our server with the MSISDN, a UID (to identify the session), their UserID &amp; PassWord.</p></li>
  <li><p>Our server will add the request to a MySQL DB and respond the website with a Code, UID and some other info.</p></li>
  <li><p>Our server will send the client a SMS with the one time password.</p></li>
  <li><p>Once the client enters the OTP into the website, the website will send another HTTPS request with the encrypted OTP to our server and we will send a success or fail code as the response.</p></li>
  </ol>
  
  <p>this is the flow i have thought about. Anyone have a better flow? or suggestions?</p>
  
  <p>Thanks.</p>