5 ms·
Except that in most "real" two-factor systems, you can't duplicate the second factor easily. The problem here is if the private key is in main memory, malware c
by tehmeh 15y ago
Except that in most "real" two-factor systems, you can't duplicate the second factor easily. The problem here is if the private key is in main memory, malware can copy it to another computer that will be indistinguishable (for the purposes of authentication) from the first. With something like a smartcard that is made much more difficult. Not impossible, but beyond the reach of most folks.
- alexchamberlain 15y agoYou have a point. I would like to see crypto chips on motherboards/in the CPU that can generate a key, export a public cert and then be asked to sign things. Then this vulnerability disappears.
- mkup 15y agoThere are TPMs exactly for this. Not very popular, though.
- alexchamberlain 15y agoThese sound awesome. Wikipedia says many laptops have them. Is this true? If so, how can I detect one on Linux?
- mkup 15y agoThere are tpm kernel modules and tpm-tools package (in Debian, for example). Also sometimes device must be turned on in BIOS Setup.
- tehmeh 15y agoAnd all of the recent Mac laptops have them. You need a special driver -- look here for a good writeup: http://osxbook.com/book/bonus/chapter10/tpm/ http://osxbook.com/book/bonus/chapter10/tpm/