4 ms·
What's the advantage of using U2F for SSH compared to using public-key authentication with a password-protected smart card (e.g. a Yubikey 4)? I can think of o
by agwa 10y ago
What's the advantage of using U2F for SSH compared to using public-key authentication with a password-protected smart card (e.g. a Yubikey 4)? I can think of one big disadvantage, which is that with U2F the password has to be shared with the remote end, which is inferior to a password that never leaves the local device.
- alexk 10y agoSasha, one of Teleport authors here. Not sharing password is definitely an advantage in this use case. On the other hand, thanks to pass + 2nd factor flow, Teleport creates unified Web and CLI SSH access using the same set of credentials. In addition to that Teleport relies on short lived certificates vs public keys, so they don't need to be explicitly revoked, don't need to be copied on every box.
- agwa 10y agoThanks for the reply. The unified set of credentials makes a lot of sense. Short lived certs are nice too. You can issue short-lived certificates for keys stored on smart cards as well.
- alexk 10y agosure thing, but then you'd need to authenticate/authorize first to get a proper set of principals and TTL, that's why Teleport authz works in a more traditional "web app" way.