3 ms·
If the system is LUKS encrypted, is there a benefit to 2FA PAM? You can set the pam to lock the system with 3 wrong passwords. In this case, even a short pin l
by aborsy 5y ago
If the system is LUKS encrypted, is there a benefit to 2FA PAM?
You can set the pam to lock the system with 3 wrong passwords. In this case, even a short pin like in a bank card would be good too.
If there is no vulnerability in OS Lock Screen, the attacker needs to reset a locked system to try the 4th password, in which case they fall behind LUKS.
If there is a vulnerability, or a direct memory access attack is used (very rare in my opinion), 2FA does not make a difference here.
So what’s the use of 2FA PAM if full disk encryption, and Pam rate limit, are used?
- gravypod 5y ago2FA would help prevent escalation of privileges in some limited situations. If you had my sudo password you still wouldn't be able to do anything unless I click the button of my 2fa device.
- yahsieh 5y agoYeah I agree with you, 2FA unlocking PCs isn't how we should use a security key. However, I do not trust using the key alone to unlock my PC as well, so I guess maybe using a YubiKey Bio is better for replacing password authentication with fingerprints.