If you own a modern #YubiKey, you might know that you can use the YubiKey Manager to enable/disable the applications & interfaces it provides.
What you probably didn't know: You can password-protect this setting using the command-line version of the Manager, with the ykman config set-lock-code command.
If you lose that lock code, you can't change the setting anymore, ever.
If it's not yet set, others with physical access to your key could disable everything, set a code and lock you out. 😬
I am mad that using it for macos unlock essentially ruins your piv slots' other usages because the mac thing sets your pins in shitty ways. Adminpin==Userpin. Userpin then replaces login password. No flags for touch requirement or no pin, pin once requirement.
Add comment