I ask this question because, I think, we now can reasonably assume the following:
- NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and boasted) about this capability in the wild.
- NSA has a database of stolen keys: They can somehow get SSH keys. The slides imply they have a database of stolen keys (I think it says something like, 'check to see if key in DB').
- It is easier to steal the private/public keys than it is to steal the TOTP from my air-gap'd phone/ipod touch.
If it is true that agencies can easily acquire keys, then would it not make more sense to use password + google TOTP second factor authentication for each SSH login?
It seems google's TOTP second factor authentication does not work out-of-the-box if publickeyauth is used. So, there is a temptation to disable public keys and use only password + second factor.
Taking the latest leaks into account, if I have to choose between public key auth and password + TOTP second auth, which is better in terms of security? (I explicitly cannot use both).
(I don't care about convenience, they are both the same for me).