3 ms·
This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system
by hvidgaard 10y ago
This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system.
- StavrosK 10y agoWhere by "completely compromise" you mean "an attacker can use your second factor while they have access to your computer and it's plugged in", which is pretty far from actual complete compromise (i.e. "an attacker can use your second factor at any time without needing to access anything of yours")
- hvidgaard 10y agoIn the context of it always being plugged in, and just handing out keys when the system asks for it, I call it completly compromised.
- nickik 10y agoNo. He still needs the PIN to actually use the Sign-Key. However that can be key-logged if your computer is compromised, so the extra 'touch' does add quite a bit of security. The U2F needs touch by definition anyway. GPG/PIV do not, this capability was added with the Yubikey 4.