6 ms·
How many people do you think have attempted to break into your home by trying to pick your door lock? If you set up an SSH instance on the public internet, how
by vageli 5y ago
How many people do you think have attempted to break into your home by trying to pick your door lock? If you set up an SSH instance on the public internet, how many times do you think your login will be tried?
- dylan604 5y agoMy login specifically? Probably a lot less than "admin" "root" or similar common things script kiddies run. But if it is on port 22, the dictionary will probably be attempted.
- vageli 5y agoThis seems tangential unless you have per-user permissions on your front door lock (which people may if they use NFC, etc) but even then, likely have a regular physical key as backup, which for all intents and purposes would be akin to the root account.
- EricE 5y agoBingo. Which is why the second factor in 2 factor authentication is "something you have". It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".
- selfhoster11 5y ago> it's trivial to social engineer phone companies into moving a phone number to a new phone Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.