Re:Using two-factor authentication for SSH
by lwf on Thursday January 14, 2016 @09:48PM
(#10906781)
> Facebook, Google, and the DOD all rely on yubikeys now to mitigate a lot of remote attack vectors.
Yes, but not as the sole factor. I've overseen a rather large deployment of Yubikeys, and I believe they provide a huge security improvement compared to other second-factor alternatives.
> The only way I know to mitigate an attacker hijacking keys like this without significantly inhibiting workflow is configuring automatic ejection and re-enumerate the device on touch.
Agreed. I was very happy when this was added in the YubiKey IV.
Yes, but not as the sole factor. I've overseen a rather large deployment of Yubikeys, and I believe they provide a huge security improvement compared to other second-factor alternatives.
> The only way I know to mitigate an attacker hijacking keys like this without significantly inhibiting workflow is configuring automatic ejection and re-enumerate the device on touch.
Agreed. I was very happy when this was added in the YubiKey IV.