What are the benefits of PIV auth for a personal Mac laptop?

Question

I have a YubiKey smartcard for challenge-response authentication with several personal online accounts. With online accounts, the benefits of two-factor authentication are straightforward: only someone with both my password and my physical key can sign in to my accounts. Smartcards are better than SMS-based challenges because access to my phone number is not sufficient for access (and apparently phone numbers are a weak link in this regard).

macOS Sierra supports using smartcard keys for signing in to a Mac (Yubico docs). I don't connect to my personal Mac laptop remotely, and I use the macOS built-in firewall to only allow certain programs to accept incoming connections. I notice that auth challenges for things like unlocking the screen, installing software, and changing preferences will use the key. I prefer to use the nub-style Yubikey that stays in my laptop's USB port, which means anyone with physical access to the laptop has the key.

Are there any benefits to using YubiKey PAM with macOS Sierra on a personal laptop with the firewall enabled? Does this provide an extra layer of protection against remote attacks, or am I equally covered (or equally vulnerable) without it? With the smartcard left in the slot, is PIV auth only useful if remote login is available or auth is remote-managed?

Answer 1

The only benefit I personally see for local auth is that it's somewhat more secure against malware (which cannot spoof root password prompts anymore).

On the one hand, "physical access" is a rather important part. A smartcard token cannot be copied (the way someone could copy ~/.ssh/id_rsa without leaving any trace), and even with physical access it cannot be cloned without quite a bit of time and resources. In general, it can only be 'borrowed' out of your USB port, which is very noticeable.

On the other hand, it doesn't help if the whole computer is stolen (or if someone can just sit down and use it), and I definitely wouldn't leave such a key permanently inserted to the computer if it's also used for web authentication – especially not if the same computer has all regular passwords stored in the web browser. (That's like writing down your PIN on the bank card itself.)