It might be nicer if you made them <i>say</i> "yes" so that replays could be detected. Pressing 1 makes the same tone every time, so malware on smartphones can easily bypass this authentication method.