Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • So what's stopping reusing hash instead of public key? Regardless, from your response I'm seeing smart cards without physical presence requirement aren't part of the solution. Let's say we get yubikey or alternative that requires physical interaction every password auth. Let's say the malware gets the pin and is able to reuse it. How would it not be able to also spoof the response from the physical interaction with the yubikey? Commented Nov 23, 2023 at 15:58
  • The YubiKey performs the physical presence check on the device itself. You touch a small gold-coloured connector on the security key to activate it. If you don't touch it, the YubiKey doesn't sign. Commented Nov 23, 2023 at 16:21