4 ms·
Could link it to a yubikey via pam.d so you need a fingerpress to authenticate.
by fragmede 6mo ago
Could link it to a yubikey via pam.d so you need a fingerpress to authenticate.
- pastage 6mo agoPhysical attestations are hard to solve, I think it would be nice if all TPMs in laptops had this. Then the problem becomes how do you automate stuff that needs to be done.
- lrvick 6mo agoAnd then the moment you authenticate, the fake sudo still executes its payload. Yubikeys do not fix this issue.
- exyi 6mo agoAt least my password won't leak as often with yubikey, but the attacker can still hack my shell to execute fake sudo. Even if I type /bin/sudo explicitly, there is ptrace, LD_PRELOAD or just replacing the entire bash binary. In practice yubikey sudo keeps you much safer today, as almost nobody uses it and malware won't be prepared for it