Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using your SIM card for MFA when logging in to an SSH server

developer.tru.id

Post reply on HN
Print view View original

31–35 of 35 posts

Re: Using your SIM card for MFA when logging in to an SSH server

#31

Post by nikolay »

lxgr wrote: post #30
nikolay wrote: post #29

Earlier quoted context omitted.

No, it's not. If you use Twilio, maybe, but there are many other options today, one of them being SignalWire [0]. Another being Plivo [1]. [0]: https://signalwire.com/pricing/messaging [1]: https://www.plivo.com/pricing/

Note that I wrote "most countries other than the US". Your first reference seems to be US only; the second one lists around 2-10 cent per message to most non-US destinations. Since this is based on what phone networks charge these service providers and other networks for inbound SMS, anything much cheaper than that is usually using unreliable SIM farms or even more dubious means of message delivery (like hijacked And…

For thouse countries, typically with lower standards of living, their pricing will be even more prohibitive! There are tricks like callbacks, etc. to deal with expensive texting and many services use those already!

Re: Using your SIM card for MFA when logging in to an SSH server

#32

Post by lxgr »

nikolay wrote: post #31
lxgr wrote: post #30

Earlier quoted context omitted.

Note that I wrote "most countries other than the US". Your first reference seems to be US only; the second one lists around 2-10 cent per message to most non-US destinations. Since this is based on what phone networks charge these service providers and other networks for inbound SMS, anything much cheaper than that is usually using unreliable SIM farms or even more dubious means of message delivery (like hijacked And…

For thouse countries, typically with lower standards of living, their pricing will be even more prohibitive! There are tricks like callbacks, etc. to deal with expensive texting and many services use those already!

Let's not get into the debate about standards of living in the EU vs. the US, but doesn't all of this outline my original point, i.e. 3-9 cents per authentication being pretty on par with what companies seem to already be willing to pay for two-factor authentication (via SMS-OTP) globally?

Re: Using your SIM card for MFA when logging in to an SSH server

#33

Post by nikolay »

lxgr wrote: post #32
nikolay wrote: post #31

Earlier quoted context omitted.

For thouse countries, typically with lower standards of living, their pricing will be even more prohibitive! There are tricks like callbacks, etc. to deal with expensive texting and many services use those already!

Let's not get into the debate about standards of living in the EU vs. the US, but doesn't all of this outline my original point, i.e. 3-9 cents per authentication being pretty on par with what companies seem to already be willing to pay for two-factor authentication (via SMS-OTP) globally?

In other words, it's an abusive copycat pricing model (if others are thieves, we should be, too). Except there's a lot more infrastructure and personnel behind a text message, so, tru.ID are bigger thieves! Also, the vast difference is that tru.ID requieres an app and SMS does not, so, you should not compare apples to oranges! If you really want your customers to install yet another app, then good luck! In fact, their app is a bit finicky as I installed it and starts with a Java error and then a endless spinner on a blank screen! Not to mention, they have 2 QR codes next to each other for download on their web pages, way too close to each other, and not sure why they don't have a simple device-based redirect with a single QR code, or use another abusive service to do this trivial job if they are not up to the challenge themselves.

Re: Using your SIM card for MFA when logging in to an SSH server

#35

Post by ThePowerOfFuet »

GregHolmes wrote: post #19
RileyJames wrote: post #12

Earlier quoted context omitted.

What are some of the reasons to use tru.ID over sending an sms? It sounds like it has some features around sim swap protection. I’d be interested in this, but how realiable is it? And what countries does it work in? Why use this over OTOP via a generator?

If you were, for example building a mobile application. tru.ID's PhoneCheck is superior to SMS in several ways. The first is, it provides a seamless UX. The user only has to enter their phone number (or your backend may already have this stored?). Then all they see is a couple seconds loading followed by a success or failure. It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for e…

> It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for example).

Awfully weak.

> Some countries have started introducing rules for certain industries where they're not allowed to switch between apps on a mobile phone. For example when trying to find their Authenticator app or checking their SMS/email for a TOTP.

Which countries are these?

> And finally, it is phishing resistant. You can phish for a users TOTP. You can't with a data connection the mobile device itself has to make over cellular data to the mobile network operator directly.

What if the user is using a VPN?

Post reply on HN