41–50 of 108 posts
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
Keys are easily (and persistently) added to ssh-agent, at which point it is easy to forward and will generally silently authorize without any further user interaction. That reduces it to a single factor.
Compare that to a totp challenge or a yubi key plus a password. Having one of them won’t get you the other.
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
This guide contains (at least) inaccurate statements. It's oversimplifying and omitting important things while putting emphasis on some exotic details where defaults would be sane enough. "One key, the public key, can only encrypt data, not decrypt it" - this is cryptographically inaccurate. One should use it that way, though. "Identity is verified by encrypting and decrypting data that both the client and server kno…
Thank you for the info. Maybe consider improving the GitHub article itself?
Earlier quoted context omitted.
Crikey, look at that mess: Upgrade the version of the browser to an approved version by obtaining software from the vendor or other trusted source. Method 1: View the following registry key: HKLM\Software\Mozilla\Mozilla Firefox\CurrentVersion Method 2: Search for the firefox.exe file using the search feature of the operating system. Examine the files properties for the product version (not the file version. For Wind…
> How about clicking on "About Firefox" in the menu? Perhaps they don’t trust it enough to execute it until they know it’s the latest version and was obtained from a trustworthy source.
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
This guide contains (at least) inaccurate statements. It's oversimplifying and omitting important things while putting emphasis on some exotic details where defaults would be sane enough. "One key, the public key, can only encrypt data, not decrypt it" - this is cryptographically inaccurate. One should use it that way, though. "Identity is verified by encrypting and decrypting data that both the client and server kno…
Fully agree. You missed the most inaccurate one: > Now you need to append the contents of the public key ~/.ssh/id_ed25519.pub to the ~/.ssh/authorized_keys file on the target server. You'll want to do this in a secure way since the public key gives access to your server.
Earlier quoted context omitted.
Fully agree. You missed the most inaccurate one: > Now you need to append the contents of the public key ~/.ssh/id_ed25519.pub to the ~/.ssh/authorized_keys file on the target server. You'll want to do this in a secure way since the public key gives access to your server.
Sorry for being so ignorant but can someone explain why this is so wrong?
Earlier quoted context omitted.
You don't have to use a closed source TOTP client such as Google's. There's RedHat's FreeOTP and there's another open source one called antOTP. You can find them on F-Droid as well. There have been TOTP PAM modules for ages (these work on a Linux client and Linux server via e.g. SSH). You can even add YubiKey to PAM. Same for BSD Auth and macOS.
> RedHat's FreeOTP It's abandonware these days and hasn't been updated for years. The iOS app doesn't work anymore and can't use the camera for reading codes.
It's not broken for the 15 or so accounts I use it for.
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
2FA would be private key (password-protected) and a separate (most likely one time use) password. Something you have (key that you decrypted) and something you know (the one-time password).
It would also be proper to disable non root access to /proc among other things. You can do that by simply mounting with hidepid=2 or adding it to fstab.
Why? Disabling access to /proc will disable a huge number of useful features, such as the ability of a process to monitor and manage its memory usage, to debug itself, and so forth.
Source: Another flip in the wall of rowhammer defenses (IEEE S&P 2018)