Use TouchID to Authenticate Sudo on macOS

Re:Use TouchID to Authenticate Sudo on macOS by adastra22 on Friday August 26, 2022 @05:46PM (#32613106)

That’s the whole point, no? Tie identity to the machine itself, not a piece of data that can be stolen.

BTW, if you have a key that you copy around to multiple machines, you’re doing it wrong!

[ Parent | on HN ]

Re:Use TouchID to Authenticate Sudo on macOS by rgoulter on Friday August 26, 2022 @11:01PM (#32615217)

It's not sufficient to be the whole point.

With some security mechanism, I'd consider:

1. prevent other people from being able to use it. 2. recover from it in case it gets lost.

If your perspective is "if I lose this laptop, I have some other way to access the systems", then it's good to never access the SSH key secret.

If your perspective is that you want your secret key to be the only way to access some system, you'll want to have some way to recover the secret.

I think in any case, it's understood that having an unrecoverable secret being the only way to access some system is a bad idea.

[ Parent | on HN ]