3 ms·

I'm somewhat surprised that using an HSM like a YubiKey or NitroKey isn't on there. Mac OS has had pretty solid support for smartcards and tokens for a very lon

by xoa 4y ago

I'm somewhat surprised that using an HSM like a YubiKey or NitroKey isn't on there. Mac OS has had pretty solid support for smartcards and tokens for a very long time now, improving significantly in the last 5 or so generations. Even for Macs with biometrics keys can still be useful in a multiuser environment or for the convenience of not needing to reach for the Touch ID (and be limited to an Apple keyboard). Login becomes a matter of just plugging in the key and entering the PIN. Most system authentication and sudo by default as well. Makes it much more convenient to have a long good password, though unfortunately FileVault (and 1Password is also a shitty, glaring example here) remains an outlier. Can disable automatic login following use of FV just fine though, and having it for system auth is still good. And it's another option (and one that can be backed up physically) for websites as webauthn spreads. It costs money but it's not technical to work with either. Hopefully the day comes when password managers are effectively obsolete because we finally finally FINALLY give up on the ludicrous practice of using symmetric information for 3rd party authentication.

judge2020 4y ago
I think this breaks the "don't compromise usability" rule set at the top. While "what you have" is quite good compared to "what you know" (a regular password), chances are the Mac they're buying has some form of Touch ID for authentication, which is only slightly worse than a physical smart card since it only opens up two attack vectors: chopping off your finger, and someone cloning your fingerprint while engineering a way to fake the sensor's liveness check.
- xoa 4y ago
  >I think this breaks the "don't compromise usability" rule set at the top. What? It's more, not less usable. You plug in a key and now all you need is a 4-8 digit PIN for most operations while still being secure, not a 20+char random password, and it's not tied to a specific system either. HSMs are one of the rare cases in security where they are both more secure and better UX. >chances are the Mac they're buying has some form of Touch ID for authentication I addressed this. That only applies to new and new-ish notebooks unless you also get a special Apple-only keyboard. Even for notebooks, it only applies if you have the notebook close, open and/or are happy to reach for it. If someone is doing the common pattern of their notebook docked at their desk to another screen and peripherals at least some of the time, now Touch ID is most decidedly not right there (again, barring sticking only to Apple keyboards). And not everyone is 100% exclusively in the Apple ecosystem, even if they have lots of Apple stuff. If website credentials are tied to keys, one can just unplug and plug it into a Linux/BSD/Windows system and still login fine. I don't disparage making use of biometrics on Macs or iDevices a single bit, and indeed I think it's weird and silly that Apple hasn't done Face ID for the Mac. But that doesn't mean USB keys or smart cards aren't super handy for a lot of Mac usage same as they are on any other system. It's a fairly polished built-in supported feature of macOS, no reason not to consider taking advantage of it.
assttoasstmgr 4y ago
That would clash with Apple's Not Invented Here syndrome. The rest of the world will quietly continue using smartcards and PIV tokens for stringent security....

by xoa 4y ago

judge2020 4y ago

I think this breaks the "don't compromise usability" rule set at the top. While "what you have" is quite good compared to "what you know" (a regular password), chances are the Mac they're buying has some form of Touch ID for authentication, which is only slightly worse than a physical smart card since it only opens up two attack vectors: chopping off your finger, and someone cloning your fingerprint while engineering a way to fake the sensor's liveness check.

xoa 4y ago
>I think this breaks the "don't compromise usability" rule set at the top. What? It's more, not less usable. You plug in a key and now all you need is a 4-8 digit PIN for most operations while still being secure, not a 20+char random password, and it's not tied to a specific system either. HSMs are one of the rare cases in security where they are both more secure and better UX. >chances are the Mac they're buying has some form of Touch ID for authentication I addressed this. That only applies to new and new-ish notebooks unless you also get a special Apple-only keyboard. Even for notebooks, it only applies if you have the notebook close, open and/or are happy to reach for it. If someone is doing the common pattern of their notebook docked at their desk to another screen and peripherals at least some of the time, now Touch ID is most decidedly not right there (again, barring sticking only to Apple keyboards). And not everyone is 100% exclusively in the Apple ecosystem, even if they have lots of Apple stuff. If website credentials are tied to keys, one can just unplug and plug it into a Linux/BSD/Windows system and still login fine. I don't disparage making use of biometrics on Macs or iDevices a single bit, and indeed I think it's weird and silly that Apple hasn't done Face ID for the Mac. But that doesn't mean USB keys or smart cards aren't super handy for a lot of Mac usage same as they are on any other system. It's a fairly polished built-in supported feature of macOS, no reason not to consider taking advantage of it.

assttoasstmgr 4y ago

That would clash with Apple's Not Invented Here syndrome. The rest of the world will quietly continue using smartcards and PIV tokens for stringent security....