3 ms·
Every time you login with a Yubikey you must tap it. It does not maintain its own session on the key or anything like that. If the app maintains a session, the
by pseudoramble 6y ago
Every time you login with a Yubikey you must tap it. It does not maintain its own session on the key or anything like that.
If the app maintains a session, then that depends on how long the app allows sessions/tokens to live for at that point. The Yubikey won't come into play until login is required again. So, I think you're getting at a different part of the security model at that point.
- Thorrez 6y agoMy point is that essentially all apps maintain a session and a remote desktop attack can make use of that session. So Yubikey doesn't really protect from remote desktop attacks.
- pseudoramble 6y agoFair enough! I didn't comprehend the context well enough. Seems right though, the Yubikey won't protect sessions. At least I don't see any reason it would.