Re: Untrusted terminals: OPIE vs security/pam_google_authenticator

Robert Simmons wrote:
> 
> To throw a new wrinkle in the equation: Google Authenticator codes can be
> intercepted by a phishing page. 

In my case, no page is involved, just the FreeOTP app on my Android
phone (which is less convenient than a sheet of paper with OPIE
passwords, but I can live with that).

> U2F protocol is even better, and can't be
> intercepted via phishing.
> 
> There are U2F libraries in ports.
> 
> https://en.wikipedia.org/wiki/Universal_2nd_Factor

U2F (and Yubikey) require purchase of hardware devices. In this sense,
they are not replacements for OPIE, which is a pure software solution. 

Back to my original question.

1. Is it safe to keep OPIE in the base system? Its upstream project
is gone. It is not IPv6 ready. It uses MD5.

2. If OPIE is not safe anymore, which is a good software replacement? 

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJdCZhYAAoJEA2k8lmbXsY0YtgH/3W6x6I99qbATT/cNMtd+KGq
fyOHglgWJn73720MpidV6cZbTwHMhAaRISFxXRAT2VAqN/zwvrgS1rRVVgTJR7Ob
NxrrzgA25YG1NbhEMdltGqSOk8oca8TRK0SY54tk3cs2YGL5Msf/Fhssbmj2iQbM
evavbdBwY7DJxOojdzvOYo56sa5DYwjax9ngwHtcwJp/24f5rEgbyoGP60/mrEsn
ko3UPS0P3jK7ujo9/5OtIovyjh1vCY45abb7SQ/KarrOV7VfNTJy1ISnSiPYVXWT
4mpSsfq4AOTUxnxjgzg/DN70HT6sW4QiJsL3yFvLMGFUah3ICiKnYOeMODsLqNU=
=q8wU
-----END PGP SIGNATURE-----