7 ms·

I’m sorry to be pedantic, that’s not exactly true. I agree in the sense that extracting hw based keys is next to impossible, but if your machine is compromised,

I’m sorry to be pedantic, that’s not exactly true. I agree in the sense that extracting hw based keys is next to impossible, but if your machine is compromised, there isn’t much stopping malware from using your hw based key (assuming 1. Left plugged in, 2. Unlocked with either ssh-agent or gpg-agent, and 3. You don’t have touch to auth turned on). Reduced risk? Absolutely. No risk? Absolutely not.

cyberax 5mo ago
Sure. They can use my key while my machine is compromised, but even then I won't _need_ to rotate it after the compromise is cleared. It still would be a good idea just to make sure that it's easier to analyze logs, but it's not strictly needed.
hsbauauvhabzb 5mo ago
And if you want to be even more pedantic, shell access with a touch based key just means the attacker has to wait for you to auth, which makes touch based systems largely a waste of effort on the defenders part.
- traceroute66 5mo ago
  > shell access with a touch based key just means the attacker has to wait for you to auth And if you want to be EVEN more pedantic, on most touch-based keys, you have to touch within 10–15 seconds otherwise it times out. So it is not a waste of effort at all. First the need to touch at all eliminates a large chunk of attacks. Second the need to touch within 10–15 seconds eliminates a whole bunch more. There would have to be some heavy-duty alignment of ducks going on to get past a touch requirement. Even more if the target has touch AND PIN enabled.
- entrope 5mo ago
  The touch based key I use only responds once per touch. If someone compromises the machine it's plugged into, the action I expected to complete won't complete. This means the compromise becomes immediately visible.
bloppe 5mo ago
Never apologize for pedantry here
traceroute66 5mo ago
> there isn’t much stopping malware from using your hw based key Except the three pretty major things that do stop malware that you mentioned ;) Perhaps especially "3. You don’t have touch to auth turned on".

cyberax 5mo ago

Sure. They can use my key while my machine is compromised, but even then I won't _need_ to rotate it after the compromise is cleared. It still would be a good idea just to make sure that it's easier to analyze logs, but it's not strictly needed.

hsbauauvhabzb 5mo ago

And if you want to be even more pedantic, shell access with a touch based key just means the attacker has to wait for you to auth, which makes touch based systems largely a waste of effort on the defenders part.

traceroute66 5mo ago
> shell access with a touch based key just means the attacker has to wait for you to auth And if you want to be EVEN more pedantic, on most touch-based keys, you have to touch within 10–15 seconds otherwise it times out. So it is not a waste of effort at all. First the need to touch at all eliminates a large chunk of attacks. Second the need to touch within 10–15 seconds eliminates a whole bunch more. There would have to be some heavy-duty alignment of ducks going on to get past a touch requirement. Even more if the target has touch AND PIN enabled.
entrope 5mo ago
The touch based key I use only responds once per touch. If someone compromises the machine it's plugged into, the action I expected to complete won't complete. This means the compromise becomes immediately visible.

bloppe 5mo ago

Never apologize for pedantry here

traceroute66 5mo ago

> there isn’t much stopping malware from using your hw based key Except the three pretty major things that do stop malware that you mentioned ;) Perhaps especially "3. You don’t have touch to auth turned on".