4 ms·
Not with the Bio series apparently, but at least on the Yubikey 4, when you're setup with OpenPGP, a tap works with a single request and it prompts you to tap w
by jolmg 5y ago
Not with the Bio series apparently, but at least on the Yubikey 4, when you're setup with OpenPGP, a tap works with a single request and it prompts you to tap with a blinking light. If it's blinking when you haven't done anything to prompt a tap, that would be something to worry about. If you do something that prompts a tap and a malicious process also requests something from the key at the same time, you'll get 2 requests. You'd tap it for the request you're expecting, see it blinking faster to confirm your tap, and then blink slowly again to request the 2nd tap. That second request would be your cue for worrying. IOW, the blinking is an alert against your scenario.
- amelius 5y agoOk, thanks! How do well does this key go together with workflows that use automation (e.g. daily rsyncs over the network that run in the background)?
- jolmg 5y agoNot sure how you want to combine automated daily rsyncs with hardware keys. You can use OpenPGP for ssh authentication, and set it up so it prompts you when rsync starts automatically. However, do you really want your automated jobs to depend on having a human to answer prompts or at least having a key inserted when it's scheduled to run? It sounds like there could be a better setup.
- staticassertion 5y agoFIDO keys are really more about avoiding human errors/ human auth. If you need to authorize a server you may want to just use a client certificate.