Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

51–60 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#51

Post by peterwwillis »

danielweber wrote: post #43
peterwwillis wrote: post #36

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

Don't let the perfect be the enemy of the good.

Can I quote you on that when the first "flaw in SMS used to circumvent two factor authentication" article comes out?

A secured data connection is much better than SMS and easy to implement. But this is still a 'something you send' factor, which can be intercepted. A physical token or 'something you have' is more secure, and can also be easily implemented with a YubiKey, a paypal/ebay authentication card, etc.

If you think your data is so valuable someone might install a keylogger to get it, you might as well secure it as well as you reasonably can.

Re: Add two-factor authentication to your ssh in 30 seconds

#52

Post by dcu »

peterwwillis wrote: post #36

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

You are not forced to use SMS, you can always use the smartphones apps.

Re: Add two-factor authentication to your ssh in 30 seconds

#53

Post by draebek »

cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Thanks for the instructions, I like the fact that Google Authenticator doesn't need to contact their servers (or at least that's how I understand it). Sounds like you could preserve the use of SSH public key authentication by using Google Authenticator in combination with a ForceCommand; I'll have to look in to that.

Anyone set up Google Authenticator to only challenge me on a host every N minutes or something like that? I.e., first login requires two-factor auth, subsequent logins don't for at least 30 minutes? Seems like it'd be irritating to keep popping my phone out every time I connect to a remote server.

Re: Add two-factor authentication to your ssh in 30 seconds

#54

Post by danielweber »

peterwwillis wrote: post #51
danielweber wrote: post #43

Earlier quoted context omitted.

Don't let the perfect be the enemy of the good.

Can I quote you on that when the first "flaw in SMS used to circumvent two factor authentication" article comes out? A secured data connection is much better than SMS and easy to implement. But this is still a 'something you send' factor, which can be intercepted. A physical token or 'something you have' is more secure, and can also be easily implemented with a YubiKey, a paypal/ebay authentication card, etc. If you…

In order for a flaw in SMS to break someone in, the attacker would need to break both SMS and the traditional authentication channel.

Yes, SMS can be broken. I'm sure Google Authenticator is vulnerable to certain attacks, too. Using them is better than throwing your hands up in the air and saying "it's not perfect, we'd better not implement it because then people will act as if they have perfect security!" Because people are already acting like they have perfect security.

Re: Add two-factor authentication to your ssh in 30 seconds

#55

Post by ikonst »

danielpal wrote: post #28
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

I use ssh keys with this setup. If I login with an ssh key, I don't need the OTP.

Re: Add two-factor authentication to your ssh in 30 seconds

#56

Post by arjunnarayan »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

Mine are written down in a post-it note stuck to the inside back-flap of my passport.

Re: Add two-factor authentication to your ssh in 30 seconds

#57

Post by ikonst »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

You can use the same key for all the servers. Just copy the files generated by the 'google-authenticator' app. I don't see any less security in that.

Re: Add two-factor authentication to your ssh in 30 seconds

#58

Post by ikonst »

piotrSikora wrote: post #24
a3_nm wrote: post #15

Does this mean that you ping them whenever you ssh? Does this mean that if their service is down you won't be able to ssh anymore?

From https://github.com/authy/authy-ssh/blob/master/authy-ssh#L11... : Default action when api.authy.com cannot be contacted: 1. Disable two factor authentication until api.authy.com is back 2. Don't allow logins until api.authy.com is back

What?! This is an online method? Why don't people just use Google Authenticator? It's totally offline, on both ends.

Re: Add two-factor authentication to your ssh in 30 seconds

#59

Post by tylermenezes »

peterwwillis wrote: post #36

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

> It can be faked. Not in the way that matters in this case - it's prohibitively difficult to receive someone else's text messages.
Post reply on HN