Using your SIM card for MFA when logging in to an SSH server
developer.tru.id
Using your SIM card for MFA when logging in to an SSH server
1–10 of 35 posts
Re: Using your SIM card for MFA when logging in to an SSH server
#2I recently wrote this tutorial to add an extra factor of authentication when logging in to an SSH server, using tru.ID's PhoneCheck, which uses your SIM card and an active data connection to the mobile network operator. Let me know what you think?
Re: Using your SIM card for MFA when logging in to an SSH server
#3Instant PhoneCheck
USD 0.030
Active SIMCheck USD 0.090
Strong SubscriberCheck USD 0.200
Re: Using your SIM card for MFA when logging in to an SSH server
#4It's very hard to follow the way this builds up a script as it goes, it's unclear what benefit putting it all in one script has, it's really a bunch of scripts.
Also the link at the end for more details, goes to https://developer.tru.id/docs/phone-check/guide which is a 404.
Re: Using your SIM card for MFA when logging in to an SSH server
#5Despite what the title suggests, this is not using the SIM and does not involve any kind of cryptographic authentication.
Re: Using your SIM card for MFA when logging in to an SSH server
#6I'd prefer using something like a U2F key that you already have to make your ssh more secure.
Re: Using your SIM card for MFA when logging in to an SSH server
#7One thing that it wasn't clear to me is, the check only verifies that there is an active SIM card, but how is that tie to a person? With one-time-password via SMS, we are not only verifying that the phone number is active but also a specific person (with the registered phone number in their account) have access to the phone. In the first case it is enough to use any phone number as long as it is active.
Re: Using your SIM card for MFA when logging in to an SSH server
#8Using your SIM card for MFA when logging in to an SSH server (through paid API requests to a third party)
There are ways to use your phone's secure storage capabilities for key storage; this tool isn't leveraging the secure compute capabilities of your phone's SIM in any way. I've dabbled with using Krypt.co [1] for this, though that's sadly been deprecated and will at some point be replaced by a paid-for cloud service from Akamai. I'm sure there are other options available as well.
A far superior method for SSH security would be a physical U2F key or even a smart card. It's also possible to set up TOTP as a second factor ([2], works with any TOTP solution, not just Google Authenticator). I don't see a need for this paid-for third party service unless you're already using their services for some kind of verification mechanism.
[1]: https://krypt.co/
Re: Using your SIM card for MFA when logging in to an SSH server
#9Can someone explain how PhoneCheck is able to verify the phone number with the mobile provider using a "mobile data session"?
Re: Using your SIM card for MFA when logging in to an SSH server
#10I recently wrote this tutorial to add an extra factor of authentication when logging in to an SSH server, using tru.ID's PhoneCheck, which uses your SIM card and an active data connection to the mobile network operator. Let me know what you think?
From a security perspective, it seems you're only confirming that whoever is trying to log in has access to the phone number - not a specific SIM card. So right away it doesn't appear to offer any benefits over other MFA options out there, and is certainly less secure than some of them.
The cost per authentication is high, and even if that weren't a concern, I'd certainly never advocate for a solution that I can't even test since my country isn't on the supported list.
Finally, getting locked out of my servers if your endpoint goes down is a hard pass. I can't really imagine anyone seriously considering implementing this type of access control to servers.