3 ms·
If you've got persistent malware on the machine (-> keylogger), 2FA with a hardware key will barely help. The malware can just notice your "sudo" call, pass thr
by delroth 6y ago
If you've got persistent malware on the machine (-> keylogger), 2FA with a hardware key will barely help. The malware can just notice your "sudo" call, pass through your password + 2FA token to its own "sudo" invocation, and make your "sudo" invocation say "invalid password" -- which you'll likely interpret as a typo.
Not that getting root is too interesting for malware running on your personal machines that runs all the interesting code as uid1000. https://xkcd.com/1200/ https://xkcd.com/1200/
- kart23 6y agoDon't have to type anything. If you don't type anything, there's nothing to keylog right? It'll send a notification to the duo app with the command name, and will allow you to verify whatever you're running. If the attacker attempts to sudo, it'll show the command they are trying to run and you can choose not to allow it.
- delroth 6y ago2FA that actually carries a payload to verify like Duo will be much harder to exploit, indeed. As to whether making your life harder for routine system administration tasks will actually make stealing your personal data harder, I still have my doubts.