Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using your SIM card for MFA when logging in to an SSH server

developer.tru.id

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Using your SIM card for MFA when logging in to an SSH server

#21

Post by GregHolmes »

alifakh wrote: post #7

One thing that it wasn't clear to me is, the check only verifies that there is an active SIM card, but how is that tie to a person? With one-time-password via SMS, we are not only verifying that the phone number is active but also a specific person (with the registered phone number in their account) have access to the phone. In the first case it is enough to use any phone number as long as it is active.

No, the check url created from the request is made by the mobile network operator assigned to that phone number.

The mobile device makes the GET request to that check url over a cellular data request. The MNO verifies the phone number assigned to that sim card making that data request matches phone number used in the creation of that check url.

Re: Using your SIM card for MFA when logging in to an SSH server

#22

Post by GregHolmes »

lxgr wrote: post #15
voltagex_ wrote: post #3

Instant PhoneCheck USD 0.030 Active SIMCheck USD 0.090 Strong SubscriberCheck USD 0.200

I haven‘t tried it, but I‘m willing to bet that at least one of these would claim that my primary phone number "is not a mobile phone number" (but I use it on a phone), "is not registered in my name" (it is, and how do you claim to know?), or "is a VoIP number, which is insecure and therefore not allowed". Phone numbers are neither good user identifiers nor viable authentication factors.

We do not verify any of your personal information. We neither have access to that nor store any of it on our system. Our PhoneCheck product simply returns a true or false. Is your phone number tied to this SIM Card. This is information the MNO already has, they know your phone number and your SIM Card. The request is made over a cellular data connection from your device to the MNO

Re: Using your SIM card for MFA when logging in to an SSH server

#23

Post by resoluteteeth »

lxgr wrote: post #16
resoluteteeth wrote: post #14

Earlier quoted context omitted.

Huh... so I guess it's entirely reliant on the mobile operator adding this header then, and it's literally just checking whether the phone number in the header matches? I think the intended method of using this API is to use apis from within a mobile app to make the request transparently (and ensure mobile data is used to avoid users having to manually disable wifi), but the person in the article is just generating a…

Sorry, that was imprecise – as far as I know it's not actually all HTTP requests, but rather only those on a list of URLs that the operator has a contractual agreement with. (I'd like to believe that this does not include advertisement/tracking purposes, or that the identifier is at least hashed for those...) Regarding an API to bypass Wi-Fi: I think at least on iOS, such a thing does not exist, and on Android I'd be…

> Sorry, that was imprecise – as far as I know it's not actually all HTTP requests, but rather only those on a list of URLs that the operator has a contractual agreement with. (I'd like to believe that this does not include advertisement/tracking purposes, or that the identifier is at least hashed for those...)

Ah, that makes more sense.

> Regarding an API to bypass Wi-Fi: I think at least on iOS, such a thing does not exist, and on Android I'd be extremely annoyed as well if an app were to possibly incur data and/or roaming charges for this. (I'm not sure whether there is an Android API to send only a specific request over mobile data without impacting other, already existing connections.)

I believe the Andorid ConnectivityManager API allows this. I didn't realize iOS didn't have something similar, although there are probably good reasons not to want apps to be able to do this.

Re: Using your SIM card for MFA when logging in to an SSH server

#24

Post by resoluteteeth »

GregHolmes wrote: post #18
resoluteteeth wrote: post #9

Can someone explain how PhoneCheck is able to verify the phone number with the mobile provider using a "mobile data session"?

The phone number is used to create the check url. This check url is returned from the mobile network operator that phone number and SIM card belong to. The device makes a GET request to the check url, with a cellular data connection. The mobile network operator is able to verify that the phone number used to create the check URL matches that of the phone number assigned to that SIM Card making the data connection req…

> The device makes a GET request to the check url, with a cellular data connection. The mobile network operator is able to verify that the phone number used to create the check URL matches that of the phone number assigned to that SIM Card making the data connection request.

I was curious how this actually worked but according to Lxgr's reply the network operator adds HTTP headers that allow the phone number to be verified.

Re: Using your SIM card for MFA when logging in to an SSH server

#26

Post by lxgr »

GregHolmes wrote: post #22
lxgr wrote: post #15

Earlier quoted context omitted.

I haven‘t tried it, but I‘m willing to bet that at least one of these would claim that my primary phone number "is not a mobile phone number" (but I use it on a phone), "is not registered in my name" (it is, and how do you claim to know?), or "is a VoIP number, which is insecure and therefore not allowed". Phone numbers are neither good user identifiers nor viable authentication factors.

We do not verify any of your personal information. We neither have access to that nor store any of it on our system. Our PhoneCheck product simply returns a true or false. Is your phone number tied to this SIM Card. This is information the MNO already has, they know your phone number and your SIM Card. The request is made over a cellular data connection from your device to the MNO

What's the difference between these three tiers of authentication, then? And what makes it different from SMS-OTP (leaving aside SS7 security concerns and focusing on SIM swapping, which I believe is responsible for the majority of successful attacks so far)?

Re: Using your SIM card for MFA when logging in to an SSH server

#27

Post by lxgr »

nikolay wrote: post #25
voltagex_ wrote: post #3

Instant PhoneCheck USD 0.030 Active SIMCheck USD 0.090 Strong SubscriberCheck USD 0.200

This pricing is outrageous!

It's actually comparable to SMS OTP delivery in most countries. (Only the US and a few other "shared cost" countries offer inbound SMS delivery for sub-cent amounts; in the EU and other "sender pays" countries, mid-single cent amounts are the norm.)

That still doesn't make using a phone number a good authentication or identification value, though.

Re: Using your SIM card for MFA when logging in to an SSH server

#28

Post by kylehotchkiss »

Does tru.id work for people using apple’s private relay service or just a VPN in general? If keeping those off is a requirement, I don’t see how this is a significant improvement over existing solutions since some people prefer to not share all their web traffic with TMobile. Webauthn with Face ID on iOS and the equivalent for android seems more compelling.

Re: Using your SIM card for MFA when logging in to an SSH server

#29

Post by nikolay »

lxgr wrote: post #27
nikolay wrote: post #25

Earlier quoted context omitted.

This pricing is outrageous!

It's actually comparable to SMS OTP delivery in most countries. (Only the US and a few other "shared cost" countries offer inbound SMS delivery for sub-cent amounts; in the EU and other "sender pays" countries, mid-single cent amounts are the norm.) That still doesn't make using a phone number a good authentication or identification value, though.

No, it's not. If you use Twilio, maybe, but there are many other options today, one of them being SignalWire [0]. Another being Plivo [1].

[0]: https://signalwire.com/pricing/messaging

[1]: https://www.plivo.com/pricing/

Re: Using your SIM card for MFA when logging in to an SSH server

#30

Post by lxgr »

nikolay wrote: post #29
lxgr wrote: post #27

Earlier quoted context omitted.

It's actually comparable to SMS OTP delivery in most countries. (Only the US and a few other "shared cost" countries offer inbound SMS delivery for sub-cent amounts; in the EU and other "sender pays" countries, mid-single cent amounts are the norm.) That still doesn't make using a phone number a good authentication or identification value, though.

No, it's not. If you use Twilio, maybe, but there are many other options today, one of them being SignalWire [0]. Another being Plivo [1]. [0]: https://signalwire.com/pricing/messaging [1]: https://www.plivo.com/pricing/

Note that I wrote "most countries other than the US".

Your first reference seems to be US only; the second one lists around 2-10 cent per message to most non-US destinations.

Since this is based on what phone networks charge these service providers and other networks for inbound SMS, anything much cheaper than that is usually using unreliable SIM farms or even more dubious means of message delivery (like hijacked Android smartphones on unlimited messaging plans used without the owner's explicit consent).

Viewed globally, cheap and reliable outbound SMS are a US-specific anomaly.

Post reply on HN