3 ms·
I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That m
by akerl_ 4y ago
I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account.
If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
- iudqnolq 4y agoI'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
- jklfhfyhjlo 4y agoBah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
- akerl_ 4y agoThe other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
- iudqnolq 4y agoThanks!