Closed bersbersbers closed 4 years ago
Likely the same thing that stops a user from adding “0000000” as a valid scratch code: if that’s part of your threat model, the cache and config files need to be stored somewhere the user can’t modify them
@akerl thank you for the answer. I meant to post this as an issue for https://github.com/atodyl/google-authenticator-libpam-auth-cache and must have done it here by accident, but your answer explains perfectly well that the way of storing the auth cache in that project is not much more insecure that what this project is doing. Thanks again.
@bersbersbers Thanks a pretty cool project! Thanks for referencing!
Would be a cool feature for this project :+1:
What stops a user from running a process to update the
.cache
file every 30 minutes, effectively disabling 2FA forever?