On Mon, 2011-10-17 at 19:14 -0700, Darren VanBuren wrote: > We definitely would need to put the secrets on a higher security box, > and even beyond that, we could look into encrypting the secrets as > well, while contributing the patch back to upstream of course. Encrypting the secrets is worthwhile but maybe curious - b/c the process that uses the secrets to determine if the otp you present is valid will need to be able to decrypt and read the secrets. So, we'd need to protect that process and whatever mechanism it uses to access the secrets. That could just be as simple as inputting a password when the process starts up and keeping all the secrets on an encrypted partition or file, etc. -sv _______________________________________________ infrastructure mailing list infrastructure@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/infrastructure
