Re:Use TouchID to Authenticate Sudo on macOS
by frutiger on Friday August 26, 2022 @04:59PM
(#32612698)
> Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.
Only if you want to protect your keys from being used by someone that has access to the private key + yubikey (i.e. someone physically present).
In other words, the -sk type private key is useless without the yubikey as well.
Re:Use TouchID to Authenticate Sudo on macOS
by boustrophedon on Friday August 26, 2022 @05:14PM
(#32612830)
Physical presence makes sense. I didn't really think it through but it's just the same as any other 2FA: you want something you know and something you have. Thanks.
Re:Use TouchID to Authenticate Sudo on macOS
by flemhans on Friday August 26, 2022 @10:02PM
(#32614869)
Are there any Linux-friendly laptops with a TPM built in?
It's nice not to have to rely on an external yubikey
Re:Use TouchID to Authenticate Sudo on macOS
by kitsunesoba on Friday August 26, 2022 @11:56PM
(#32615489)
It's not a perfect rule but anything a generation or two behind and has a GPU that's either integrated (Intel or AMD) or discrete AMD with Intel wifi and bluetooth are going to have a pretty good chance of handling a reasonably recent Linux distro (e.g. Fedora or Ubuntu non-LTS) well. While Nvidia provides official Linux drivers, I've personally had more trouble out of them than I have the stock Linux drivers for Intel and AMD GPUs.
Any laptop that is listed as supported by Windows 11 will have an onboard TPM.
`ssh-keygen -t ed25516-sk` or `ecdsa-sk` and then you touch your yubikey when unlocking the key, the same time as you would type a password.
Question for anyone else reading: Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.