My method reduces the threat of exfiltrated keys when someone or something manages to bypass the aforementioned methods without the need to purchase anything or use anything proprietary.
reply- One must connect from the correct address and with the correct TCP options.
So for example I could give you one of my ssh private keys and it would be entirely useless unless you were on my home internet connection using a device that emits my TCP options. (Or this could be a corporate SNAT pool or corporate VPN pool.).
Even the most clever MitM (man in the middle) attacks become significantly harder to perform. Leaks happen, I reduce the blast radius of the damage.
Just protect your keys in HSMs and all of this TCP mumbo-jumbo trying to pretend to be a secondary weak password becomes entirely unnecessary.
replyEveryone is free to choose what options work best for their needs and budgets. I would never attempt to inhibit anyone's choices. I use what has worked well for me and stifled red-team members.
replyYes and you can change the protocol field in your TCP stack to run all connections over ip protocol 200 too, but it doesn’t add any security to your authentication system over and above your private key. What you are doing is the same thing; lots of extra too-clever-by-half complexity that doesn’t actually benefit you.
reply"Security by obscurity isn't."
reply[delayed]
reply"Security by obscurity isn't."
replyCorrect. Thankfully none of what I am doing is security through obscurity. It's actual security with a subtle scent of obscurity. If it was just obfuscation and you knew something, then you could do that something from somewhere else which you can not.