4

在南極洲收銀行 OTP 簡訊的方式

 1 year ago
source link: https://blog.gslin.org/archives/2022/11/15/10950/%e5%9c%a8%e5%8d%97%e6%a5%b5%e6%b4%b2%e6%94%b6%e9%8a%80%e8%a1%8c-otp-%e7%b0%a1%e8%a8%8a%e7%9a%84%e6%96%b9%e5%bc%8f/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

在南極洲收銀行 OTP 簡訊的方式

看到「SMS Multifactor Authentication in Antarctica」這篇,講在南極洲收銀行 OTP 簡訊的方式 (one-time password,常見的形式是六碼或是七碼數字)。

很明顯的,南極洲沒有什麼電信商可以讓你漫遊 XD

一開始是試著用 Verizon Messages Plus,這個服務可以在電信商直接把簡訊改成 e-mail 寄出來,但作者發現所有的簡訊都會轉送,就是銀行的不會轉送 XDDD

接著是試著用 Google Voice 的號碼,但銀行會判定為 VoIP 電話而不送。

另外的方式是「Wifi Calling」,看起來應該是 VoWiFi 這個台灣更常見的詞,透過 internet 連到電信商的網路掛進去,而不需要透過電信商的基地台。

McMurdo 的網路目前還是有很多不一樣的限制與問題:

At McMurdo, phones have access to a wifi network only for wifi calling and texting, not for general Internet access. It’s just a prototype at this time. It doesn’t work in all cases or in all areas, and for one reason or another it doesn’t work for some people, even if they’ve followed all the steps for enabling wifi calling.

看起來作者遇到的問題是 latency 過高以及頻寬不穩定的問題:

Also, the protocol assumes terrestrial broadband with reasonable latency and bandwidth. At McMurdo, as of this writing, latency to terrestrial locations is in excess of 700 milliseconds. Usable bandwidth for any given end user can vary widely, down to a few dozen kilobits per second.

然後也很難 troubleshooting:

The protocol also doesn’t expose any useful diagnostic info to the end user in order to troubleshoot. You just have to cross your fingers that the magic “wifi calling” icon lights up.

接下來作者嘗試的是 Voice MFA,但不存在這樣的電話號碼可以轉接之類的:

Direct inward dialing to US Antarctic stations isn’t generally available, so you probably can’t configure your cell phone number to forward to a number you can directly answer on-station. (I’m aware of some exceptions to this.)

作者最後提了兩個方法,第一個是想辦法找一個銀行不會擋的虛擬號碼註冊,但這個方法基本上是個貓抓老鼠的遊戲。第二個是作者實做的方法,自己搞 relay,透過 IFTTT 或是其他類似的工具來轉:

c0IDijp.jpg

轉出來像是這樣:

S5Bl8MB.png

也許等基礎建設好一點之後,VoWiFi 應該就有機會通?

Related

Two-factor authentication

工具要正確的被使用才有效果。 傳統只輸入密碼的方式有時被稱做 One-factor authentication,因為 Two-factor authentication 是指兩種以上的認證,通常是透過 USB 外接 Smart card 讀卡機用卡片另外做認證。 美國網路銀行將身份檢查的部分改用 Two-factor authentication 進行認證,希望可以對抗 Phishing (網路釣魚)。問題這樣還是會受到 Man-in-the-middle-attack 與 Trojan (木馬) 的攻擊。 以 Smart card 作為 Two-factor authentication 的架構來說,Man-in-the-middle-attack 攻擊是在使用者瀏覽釣魚頁面時去原來的網路銀行上抓 Two-factor authentication 所需要的 Message,傳給使用者後讓使用者認證。使用者認證完 (密碼以及 Smart card 對 Message 的數位簽名) 送回釣魚頁面,釣魚頁面再送回原來銀行網頁,完成認證的動作,接下來開始把錢轉帳到其他戶頭去。這也就是 Bruce Schneier 這篇 Fighting Fraudulent Transactions 提到美國銀行以及政府所使用的 Two-factor…

November 28, 2006

In "Computer"

蘋果的 Two-Factor Authentication...

在「Apple Adds Two-Factor Authentication to iTunes Accounts」看到蘋果支援 Two-Factor Authentication。蘋果官方的 KB 在「Apple ID: Frequently asked questions about two-step verification for Apple ID」這邊。 看說明是透過簡訊進行認證,類似於 Facebook 的方式。不過拿了自己的帳號測試發現還看不到這個選項,應該是全球逐步開放?

March 24, 2013

In "Computer"

為什麼有了 Google Authenticator 還要使用實體的 Two-Factor Token?

如標題的問題,因為 token 可以將 secret key 實體隔離開。 可以讀看看最近這篇報導:「Zitmo Trojan Variant Eurograbber Beats Two-Factor Authentication to Steal Millions」,其中這段: To date, the researchers said, Eurograbber has infected more than 30,000 users and stolen an estimated 36 million Euros. 對於開發木馬的人,銀行服務算是「經濟效益」最高的「投資」... 用簡訊也有類似的問題,實體的 OTP 算是目前最能抵抗這類攻擊的方式了...

December 10, 2012

In "Computer"

a611ee8db44c8d03a20edf0bf5a71d80?s=49&d=identicon&r=gAuthor Gea-Suan LinPosted on November 15, 2022Categories Computer, Financial, Murmuring, Network, Security, Service, SMS, TelephoneTags antarctica, authentication, bank, calling, mfa, mobile, otp, phone, security, sms, virtual, voice, wifi, wlan

Leave a Reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Notify me of follow-up comments by email.

Notify me of new posts by email.

To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Learn More)

Post navigation


About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK