3 ms·

Just curious; is this the Yubico guide you're referring to? macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/15000015

• Fnoord 7y ago
  No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich. [1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
  • miles 7y ago
    Thanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.
    • Fnoord 7y ago
      Yes, it does, though I had to set it to lock immediately in System Preferences (triggers immediately the screensaver; first guide you linked explains how to do this). I'm using the Word Of The Day screensaver, so it is really inspiring to get back from grabbing a cup of coffee. Also, remember you only need to enter the PIN, which I'd argue is a good thing as I don't want to enter my password in public (I don't even know my password out of my head). If you boot up, you need a password of a username to unlock FileVault, but I use a different username for that (who does not have root, though for forensics this is an attack vector).
      • Fnoord 7y ago
        And enable "Turn on screensaver when login token is removed" at System Preferences -> Security & Privacy -> General -> Advanced