« first day (4906 days earlier)      last day (267 days later) » 

00:05
pretty sure, yes
@Mgetz this answer implies you've never seen it or used it yourself but guess it must be widespread
that's an interesting way of saying "dunno, I guess so" :p
I didn't dig into how PAM works
it's just an auth module
I could have, but eh
Apparently, challenge-response authentication is typically used when using keyboard-interactive authentication, not with key-based authentication (using public/private key pairs).
00:21
Speaking of which, ssh keys are not exactly secure, is it? Someone can steal your phone & laptop (possibly at the same time) and get your finger prints off a cup/glass that you have used, or from some other public place and you stand to lose everything?
 
1 hour later…
01:46
@TelKitty what does a cup even remotely have to do with ssh keys?
 
1 hour later…
03:10
@LandonZeKepitelOfGreytBritn biometric log-in to your device
@ratchetfreak huh? Does that rely on ssh?
no but it means that an attacker wouldn't need to know your password to get access to your keys
in the worst case
well... so there is no link between ssh and cups
also I checked the RFC for ssh public key authentication, the signature signed with your private key includes the "session identifier" which "uniquely identifies this session and is suitable for signing in order to prove ownership of a private key."
so replay, even if you did get a plaintext feed, of the auth exchange would not be possible
more generally described in this adjoining RFC: datatracker.ietf.org/doc/html/rfc4251#section-9.3.3
 
4 hours later…
07:31
@Mgetz actually that's not applicable to my case due to the CA that is involved
We've got 100+ groups of embedded devices out in the field. Every group is constituted of 4 systems. I was considering certificates when doing SSH from one device to another inside that group.
BUt that doesn't seem to be suited for such use-case.
 
4 hours later…
11:38
 
3 hours later…
14:13
@LandonZeKepitelOfGreytBritn Biometric log-in to your laptop, on which keys and passwords are stored, also finger prints to unlock phone for 2 step verification, after which, can just proceed to steal all your stuff.
14:32
@LandonZeKepitelOfGreytBritn it can be fine actually. But you need to support OCSP
you don't actually need a 3rd party CA for that

« first day (4906 days earlier)      last day (267 days later) »