3 ms·

At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN. Regrettably, that's not often offered as a feature, even wh

by Terr_ 7mo ago

At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN. Regrettably, that's not often offered as a feature, even when the infrastructure is already there.

akdev1l 7mo ago
Notably macOS cannot do this
- parl_match 7mo ago
  Careful with absolutist statements :) macOS can in fact be configured to use a third party idp, including interactive elements, on loginwindow. So, you could build your own through the ExtensibleSingleSignOn and Extensible Enterprise SSO macOS plugin API. You would do touchid, and then have it pop your own custom window/app, providing a prompt through that API, except it's just a hardcoded value (or some shit idk) https://youtu.be/ph37Yd1vV-c https://youtu.be/ph37Yd1vV-c So yes, macOS can in fact do that. Just not out of the box. I strongly believe that it is a glaring omission, or at least something they should gate through lockdown mode. idk!
- midtake 7mo ago
  If you create a piv certificate on a yubikey and just plug it in while logged in, it automatically registers it as a login method.
  - akdev1l 7mo ago
    Yeah but then it will only use the certificate on the yubikey and not ask for a password so we’re back to 1FA
    - midtake 6mo ago
      It's 2FA because you need the pin for the Yubikey as well.