Yubico Forum

Hello!

it is announced on Yubico website that starting from Sierra macOS supports logon with smartcards. That said, it becomes possible to logon to macOS using Yubikey's PIV module, not only PAM. But which one is better from security perspective? Shall one prefer new PIV-enabled way or stick to old PAM?

Thanks!

I can't speak directly to the security, but from an ease of use I much prefer the PAM. I converted to the smartcard method once Sierra was released, and now it successfully unlocks when I enter my pin from screensaver lock, but I am now frequently asked to provide my password to unlock my Local Items keychain for applications. When I was using the PAM method, this did not occur.

Secondarily, I have not found documentation as to whether I can enroll multiple Yubikeys as smartcards for my account. I have two for my work machine (one 4, one 4 Nano), and in PAM mode, I had them both enrolled in case one was lost or left at home, etc. This latter question is what brought me here today, but I don't see any posts on point.

Best of luck

Yes, multiple YubiKeys can be added to the same account via PIV. Just go through the same setup procedure (start to finish).

Thank you for that information.

Good stuff on the topic:
http://www.richard-purves.com/2017/02/1 ... v-and-pam/

interestingly, Richard Purves recommends (see reference in my previous post) using BOTH PIV and PAM logon at the same time. In my understanding PAM is something stronger, because 1) it's based on challenge-response, so an adversary won't be able to mount a replay attack, 2) you can require presenting your key with PAM, while with PIV both username/pwd and Yubikey/PIN will log you on.

So what are the benefits of invoking PIV in addition to PAM? any ideas? thanks!