3 ms·

There are scenarios where 2FA makes no sense for me. These are local password managers and SSH keys. Rethink this again: If your ssh key is compromised then yo

There are scenarios where 2FA makes no sense for me. These are local password managers and SSH keys. Rethink this again: If your ssh key is compromised then you have a problem overall. For my point of view there is no real security gain in 2FA ssh key logins because your private key itself is already a secret! Only thing which is important is to set a good passphrase for your ssh key. However I can think of one exception of 2FA on top of ssh keys which might be useful: 2FA for gaining root access or sudo commands. This might be okay but the attack vector in this scenario would be that someone can see your keystrokes or clipboard (then they most likely also have your ssh private key if they can do that).

syntonym 8y ago
As long as you have a passphrase and don't actually circumvent it (by e.g. an agent) you basically already have 2FA (you need access to the key (on your laptop/pc) and you need access to the passphrase (in your head)). But physical 2FA (like smartphone based ones or smartcard based ones) are nice because you can remove them from your computer or destroy them. You can't "destroy" a passphrase, so passphrase and sshkey are not really "independent".