Re:Using your SIM card for MFA when logging in to an SSH server
by ThePowerOfFuet on Thursday August 18, 2022 @03:56PM
(#32514151)
> It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for example).
Awfully weak.
> Some countries have started introducing rules for certain industries where they're not allowed to switch between apps on a mobile phone. For example when trying to find their Authenticator app or checking their SMS/email for a TOTP.
Which countries are these?
> And finally, it is phishing resistant. You can phish for a users TOTP. You can't with a data connection the mobile device itself has to make over cellular data to the mobile network operator directly.
What if the user is using a VPN?
It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for example).
Some countries have started introducing rules for certain industries where they're not allowed to switch between apps on a mobile phone. For example when trying to find their Authenticator app or checking their SMS/email for a TOTP.
And finally, it is phishing resistant. You can phish for a users TOTP. You can't with a data connection the mobile device itself has to make over cellular data to the mobile network operator directly.
There is an API specifically for SIM Swap. Or SubscriberCheck does both PhoneCheck and SimSwap together. Further increasing the security of the authentication process for the mobile app.