Earlier quoted context omitted.
By stealing the device.
It does not scale.
It doesn't have to scale. If you're the target, they only have to target you.
Passwordless Logins with Yubikey
21–30 of 66 posts
Re: Passwordless Logins with Yubikey
#22Earlier quoted context omitted.
By stealing the device.
It's most likely easier to brute force a password than to break into someone's house. Would be easier to demand all credentials by gunpoint with that much effort.
That's a fair point, but that's not the only attack vector. I carry my token around on my keys which makes it vulnerable to being pick pocketed or just left behind somewhere. I think the original point was that you're just shifting your single authentication factor, not necessarily making it more secure. My key is only used for 2FA so even if someone were to get access to it, they'd have to know my password as well to get use out of it.
Re: Passwordless Logins with Yubikey
#23This is a complete aside, but last year I purchased a keychain YubiKey 5, that supported USB-C and Lightning.
I attached it to my key ring, and within about 8 weeks, the device was destroyed through the general wear and tear of being in my pocket. The plastic started chipping at one end of the device, and before the long the entire plastic shell shattered off completely exposing the board underneath.
Was a pretty big bummer, and kept me with going back to Authy. Are there any other hardware key/tokens that are maybe a bit more rugged?
Re: Passwordless Logins with Yubikey
#24For SSH, use native U2F/FIDO2 OpenSSH support instead:
https://www.openssh.com/txt/release-8.2
https://cryptsus.com/blog/how-to-configure-openssh-with-yubi...
TOTP with a PAM module is insecure since it's not cryptographically tied to the session like public key auth and can be phished. The author's suggestion to use it for passwordless login is dangerous when applied to SSH sessions!
Re: Passwordless Logins with Yubikey
#25Re: Passwordless Logins with Yubikey
#26Earlier quoted context omitted.
The auto lock on device removal with udev rule would be the same idea, in fact you could use any USB device like a basic flash drive if you wanted. Changing PAM's login to use the device for login would require a bit more device-specific stuff--I'd search around to see if Safenet already provides a module to drive PAM auth.
This pam_usb fork can be used to set up any USB for authentication: https://www.linuxuprising.com/2021/02/how-to-login-with-usb-...
This are PKI tokens, like smartcards. I would like something tied to a certificate and private key on the device. That would be unforgeable
Re: Passwordless Logins with Yubikey
#27This is a complete aside, but last year I purchased a keychain YubiKey 5, that supported USB-C and Lightning. I attached it to my key ring, and within about 8 weeks, the device was destroyed through the general wear and tear of being in my pocket. The plastic started chipping at one end of the device, and before the long the entire plastic shell shattered off completely exposing the board underneath. Was a pretty big…
Hmm, maybe that is particular to that model? I've only had Yubikeys that are regular USB sized, carry them around on keychains all the time dangling from a bag, but haven't had a problem in the years I've owned it. Generally they are considered pretty durable I thought. (But also wouldn't mine hearing recommendations for others for the future.)
Re: Passwordless Logins with Yubikey
#28Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
"Something you have" is generally an improvement over "something you know" for most people's account security. You have to remember where we are starting from - most people are still using the same password across all their accounts.
Most people won't purchase and use a Yubikey either though. Really just depends on your threat model, if remote attacks or local attacks are of higher risk. An obvious improvement would be the use of both a password and physical security token.
Re: Passwordless Logins with Yubikey
#29TouchID on MacBooks can also be used to authenticate the user in terminal, mostly for sudo.
The only annoying thing about it is that "/etc/pam.d/sudo" gets overwritten on every macOS system upgrade.
https://apple.stackexchange.com/questions/259093/can-touch-i...
Re: Passwordless Logins with Yubikey
#30Tried this long ago when we got our first Yubico U2F keys. Cool, but ultimately unwise if not paired with a password or a decent-length pin because without that second factor you're back to a single point of (security) failure. Also, as pointed out by @deehouie, at present the pam changes required will complicate things where a machine is shared by multiple users (unless, of course, you just leave the key plugged in all the time: at which point... well, you know).