Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change -setup to generate a key with "touch policy" of "cached" instead of "always" #146

Open
gene1wood opened this issue Dec 3, 2023 · 0 comments · May be fixed by #147
Open

Change -setup to generate a key with "touch policy" of "cached" instead of "always" #146

gene1wood opened this issue Dec 3, 2023 · 0 comments · May be fixed by #147

Comments

@gene1wood
Copy link

Would it make sense to have the -setup argument default to using the cached touch policy instead of the always policy?

https://github.com/FiloSottile/yubikey-agent/blob/2e5376c5ec006250c12c1b6de65fa91de9afe687/setup.go#L143C20-L143C37

Cached: a touch is not needed if the YubiKey had been touched in the last 15 seconds, otherwise a touch is needed

Only suggesting as I ended up in this situation

  • Generated a key using yubikey-agent
  • Deployed it to a bunch of servers
  • Discovered that when doing a set of git actions that connect to GitHub 3 or 4 times, the always touch policy that the key was generated with requires touching the yubikey 4 times in a row to make 4 connections

It's very possible though that choosing the always touch policy is intentional and there's a good security story for this choice in which case feel free to disregard my suggestion.
gene1wood added a commit to gene1wood/yubikey-agent that referenced this issue Dec 3, 2023
@gene1wood
Change touch policy from always to cached
41262f2 
This will change the key that's generated when running `yubikey-agent -setup` to a key
with a touch policy of "cached". This will mean that "a touch is not needed if the YubiKey had been touched in the last 15 seconds, otherwise a touch is needed"

Fixes FiloSottile#146
@gene1wood gene1wood linked a pull request Dec 3, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Change touch policy from always to cached gene1wood/yubikey-agent
1 participant
@gene1wood