I use a Yubikey Nano (USB-C) and it allows me to 2FA very conveniently. When I plugged it in, my macOS gave me the option to pair it with my login account and use it as a way of logging in as well. I was happy to do that as it shortened the password at times when I needed to use it. However, the side effect has been that my TouchID is no longer active, as I never get the opportunity to enter my macOS login password. And that is required for TouchID to do its thing. I can trigger the password prompt by forcing scenarios that required TouchID to work (for example, triggering biometric auth in software like Bitwarden.) I can also do the same by temporarily unplugging the Yubikey every time I reboot. Is there a cleaner way of prompting TouchID to arm itself by asking me my macOS login password? A shell command maybe?

My Yubikey is generally working fine on macOS: * It can always write an OTP as a keyboard * ykman always works * gpg --card-status works for a while after I plug the Yubikey However, after a while when running on a USB hub, gpg --card-status stops working and shows the following error instead:

% gpg --card-status
gpg: selecting card failed: Operation not supported by device
gpg: OpenPGP card not available: Operation not supported by device

Unplugging and replugging the Yubikey solves the problem... for a while. The Yubikey is plugged into my screen (which is plugged to the MacBook over USB-C). The exact same setup *always works* on Linux. What could be causing this? Could it be that macOS somehow does something with smart cards, which would interfere with the gpg-agent? I noticed that macOS regularly shows notifications that essentially say that "a smartcard was plugged" and "a smartcard was unplugged" (I would say every few minutes). This sounds like there may be something conflicting (maybe a macOS service trying to access the smartcard?).

PROBLEM: I set my Macbook Air (Late 2013/A1466/Big Sur) to "enforceSmartCard" to True (for testing) and thought I set it back to "False." But seems I didn't. So after rebooting, the computer started asking for a PIN at login after attempting to enter my password (as it should be, considering I set the property). BUT... There was NEVER a smartcard paired with the laptop, so there is NO PIN to be entered. Also, the Smartcard PIN dialog doesn't even show up, even if there would be a PIN to use. NB: This happened to be the problem I was trying to fix in the first place. A PIN dialog used to happen when inserting the smartcard into the reader when logging in to the organization's Citrix Access Gateway, but stopped completely after being hit or miss. The smartcard was never paired with my laptop. The card and PIN are only used to access a virtual desktop via Citrix. ATTEMPTED FIXES: 1. Swearing a lot at the computer -- Didn't work; didn't think it would. 2. Safe Mode -- Still asks for PIN. 3. Recovery Mode Terminal - can't run sc_auth or security smartcard commands. 4. Single User Mode - can't run sc_auth or security smartcard commands in SH, ZSH or BASH. 5. Target Mode - Tried connecting the current Intel Macbook to an M1 Macbook. When Intel Mac was in Target Mode, the M1 Mac couldn't see it (Thunderbold-USB C connection). Then I used instructions at: Transfer Files Between Mac Silicon and Mac Intel . I could go into Recovery Mode with the M1 to start sharing the M1, but I can't get into the Intel Mac, so I'm SOL. 6. Recovery Mode OS Big Sur Reinstallation: Still asks for PIN. 7. Called Apple: The tech support advisor first said "it seems to a problem with your smartcard, so talk to the issuer." The smartcard worked (almost) fine before, and it was I who made the laptop enforce smartcard use. 8. Talked to the Support Supervisor: She tried to reach another team (Like Business and Education) but couldn't get through. She could only end up pointing me to the page that originally helped enable my derpitude. Advanced smartcard options on Mac On a scale of 1 to ImCompletelyAndTotallyHosed , where am I? I find answers to smartcard problems on the interwebs IF you have access to the computer after logging in, which I can't. Last option: Pull the drive and stick in an NVMe external drive case to hopefully access my user data (assuming I didn't faff that up, too), and the wipe the drive and do a clean OS install. Any suggestions welcomed. Thanks in advance!

**Quick History:** I purchased a 2023 Macbook Pro 16" a few months ago and promptly *followed some guide that enables Smart Card authentication for DOD sites in Firefox.* I wish I knew all the actions I did, but I think my ADHD got the best of me cuz I don't seem to have documented anything. **Issue:** When my Smart Card is inserted into my CAC reader, and I use sudo or try to unlock the screen, it prompts me for my Smart Card PIN instead of my local account's password or fingerprint. **Questions:** I think I can fix it via a combination of sc_auth identities and sc_auth unpair -h*[hash]*, but before I do that: 1. Will the commands above affect my ability to authenticate into work-related web sites and VPNs with my Smart Card, or does it strictly only remove authenticating into my laptop with my Smart Card? 2. What could I have done that paired my Smart Card to my local account (so that I can avoid doing this later)?

What OS process can I kill or force quit to terminate Kerberos? It's gotten into some bad state where choosing Sign in only brings up an empty white box (missing the normal prompts inside). I use Kerberos with a SmartCard on a regular basis. My IT coordinator informed me that my PIV certificate was expiring soon. To check the exact date, I did a Sign out, and then clicked Sign in - so far, so good - in the expected pop-up window, I clicked my certificate and clicked inspect, finding that it's end date is not til the end of October. But after the certificate inspection and closing that window, I can't login to Kerberos; I just get the blank pop-up window. I don't see a clear way to restart the process, either from the icon dropdown on the menu bar, or from Activity Monitor (I can restart my Mac, just prefer not to). It must be a running process, but none of the names jump out at me as being for kerberos. I'm running Ventura 13.5.

My goal is to send a signed email using a smart card (CAC). On support.microsoft.com , I found a help page that shows how to use sign the email using a cert, but I can't figure out how to select the smart card with the certificate. I'm using a SCR3310 card reader, I have the drivers installed. I can use the card ready to access web sites that require the cert. How do I now access the smart card from Outlook? Here is a screenshot showing the cert selection in Outlook.

I would like to know if it’s possible to log into MacOS with a tap card like you would use for access control on facility doors etc. I am familiar with smart cards and would strongly prefer my employees be able to log into POS Mac machines without having to insert a card. These would all be linked to local accounts and all of my research leads me back here to an answer involving CAC and chip insertion at https://apple.stackexchange.com/questions/135718/logging-onto-mac-with-rfid-cards Am I barking up the wrong tree here? Can you only login/unlock a Mac using a chip card if it’s inserted vs tapped and held? Or am I missing something beyond obvious? Because I of course see touch-and-hold chip reading for credit cards every day on pay terminals. Thank you for your insights.

I have a Mac Mini, running Monterey, and am trying to install a new version of Visual Studio for mac. When I install the app, it asks for the admin password. I try to enter the password, but it says I need to authenticate using SmartCard Authentication. The Yubikey is currently inserted into the Mac Mini. The login screen is asking for a PIN like it should be.The terminal also prompts for the pin instead of the password, but for some reason, the app installer is asking for the password instead. I have a profile installed to force Yubikey + PIN, so I don't know why it asks for the password instead of the PIN. I also see that the User preferences ask for a password instead of a PIN when I try to unlock it to make changes. Is there something I am missing to fully enable the Yubikey + PIN authentication for everything on the mac? I already created the user mappings and applied the profile to enforce Smartcard + PIN only.

The YubiKey provides authentication with PIV. How can I use my YubiKey smart card certificate to connect securely to other hosts with SSH using the public key method?

I am trying to get a smart card reader functioning on my Mac just upgraded to 12.1 and the reader is seen by the system, and the card is shown, but no certs? Can put the card in a computer next to it (running windows and different reader) - works fine, bought a second reader same symptoms as the first on the Mac. I cannot view the card in KeyChain, and the commands I am executing don't seem to see the certs on the card. (Can validate I am going to include as much detail as I can; hopefully, it's just a misconfiguration: (PIV card works (tested it on a different system), unsure of the reader as it's brand new (bought it a while back, but put it in the box and never used it). ➜ Downloads ./cert_read.py Running: 'system_profiler SPSmartCardsDataType' and parsing output... There were NO certificates found. Is your badge inserted? Here's all we saw in output (should be more than 100 lines) : SmartCards: Readers: #01: Alcor Micro AU9520 (ATR:{length = 17, bytes = 0x3bd6970081b1fe451f878031c152411a2b}) Reader Drivers: #01: org.debian.alioth.pcsclite.smartcardccid:1.4.32 (/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle) Tokend Drivers: #01: com.thursby.tokend.pkard:1.7 (/Library/Security/PKard/10.6/PKard.tokend) SmartCard Drivers: #01: com.apple.CryptoTokenKit.pivtoken:1.0(disabled) (/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/pivtoken.appex) Available SmartCards (keychain): com.apple.setoken: com.apple.setoken:aks: Available SmartCards (token): com.apple.setoken: com.apple.setoken:aks: Computer: macOS Mojave 10.15.7 USB - C Card reader: GSR205 - USB C IOGEAR (I checked the manufacturer's website, and there are no drivers available for download) The card reader shows up as the following in the PKard assistant: EMV Smart cardreader. The second card reader shows up as follows: ➜ Downloads ./cert_read.py Running: 'system_profiler SPSmartCardsDataType' and parsing output... There were NO certificates found. Is your badge inserted? Here's all we saw in output (should be more than 100 lines) : SmartCards: Readers: #01: SCR3310 Smart Card Reader (ATR:{length = 17, bytes = 0x3bd6970081b1fe451f878031c152411a2b}) Reader Drivers: #01: fr.apdu.ccid.smartcardccid:1.4.34 (/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle) #02: com.scmmicro.drivers.scmccid:(null) (/usr/local/libexec/SmartCardServices/drivers/scmccid.bundle) SmartCard Drivers: #01: com.apple.CryptoTokenKit.pivtoken:1.0(disabled) (/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/pivtoken.appex) Available SmartCards (keychain): com.apple.setoken: com.apple.setoken:aks: Available SmartCards (token): com.apple.setoken: com.apple.setoken:aks: also here is PCTEST: Enter the reader number : 01 Waiting for card insertion : Command successful. Testing SCardConnect : Command successful. Testing SCardStatus : Command successful. Current Reader Name : SCR3310 Smart Card Reader Current Reader State : 0x54 Current Reader Protocol : 0x1 Current Reader ATR Size : 17 (0x11) Current Reader ATR Value : 3B D6 97 00 81 B1 FE 45 1F 87 80 31 C1 52 41 1A 2B Testing SCardDisconnect : Command successful. Testing SCardReleaseContext : Command successful. Testing SCardEstablishContext : Command successful. Testing SCardGetStatusChange Please insert a working reader : Command successful. Testing SCardListReaders : Command successful. Reader 01: SCR3310 Smart Card Reader I have tried to insert/reinsert the card, connect and reconnect the reader, and tried different ports with a few reboots to add to see if anything would change..no dice. Also upgraded from Catalina to Montrey.

I originally posted this on Information Security but am hoping to attract an answer here since this is OSX specific. So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my webserver using a key stored on my NitroKeyPro making my keychain more portable and secure in the process. I followed this guide http://xmodulo.com/linux-security-with-nitrokey-usb-smart-card.html pretty much step by step but noticed that in the end, I did not need my NitroKeyPro to be inserted into my computer at all for the authentication to succeed. I have a feeling that upon exporting my key it somehow got added to my local key storage making the NitroKey redundant but I am not knowledgable enough about the exact workings to be sure. Would anyone be able to help me ensure that I can only SSH into my web server while my NitroKey is inserted into my computer? Notes: - OS: OSX El Capitan 10.11.4 - NitroKeyPro - Even while the NitroKey is inserted into my computer it does NOT ask me to enter a pin when I attempt to SSH. - OpenSC 0.15.0 - gpg 2.0.28 I tried removing from ~/.ssh the following: id.rsa private_key.pem after attempting to SSH to my web server again I get: Permission denied (publickey,gssapi-keyex,gssapi-with-mic). I assume this indicates that the SSH session cannot find my key to authenticate with, I checked if my computer was detecting the NitroKey by running: > gpg --card-status and received card information like I would expect.

I have setup my Yubikey as a smart card so I can login with the key and its PIN code. After logging in with the Yubikey, the login keychain is unlocked. However, opening a keychain item en trying to show a password, Keychain Access asks for my login password instead of my PIN. Applications trying to access the keychain requiring me to authenticate also ask for my login password instead of the Yubikey PIN. Is it possible to convince Keychain Access to allow me to authenticate with the Yubikey and PIN code instead?

I've seen a lot of questions about adding a smart card login to a Mac, but my problem is the opposite. I have a company smart card that I use on my personal computer sometimes for checking webmail and such. However, at some point I must have done some Keychain stuff with it inserted into the USB reader, because ever since it requires me to insert the smart card and enter its pin in order to unlock my lock screen or to approve software installs and updates. **Note:** I **can** Switch Users and login normally to those accounts. I don't want to mess up my keychain, so I'm hoping someone can tell me what I need to do to bring things back to normal so I can manage my personal computer with just my personal credentials.

In OSX Yosmite, the pcsc service was replaced with Apple's own "Crypto Token Kit" for handling smart cards. We used to be able to restart pcscd like in this answer , but I have not been able to find a way using the new service. Is there any way to restart the Crypto Token Kit without rebooting the machine?

For many years ago I installed/modified something in the OS to enable Smart Card support. I am now at OS X Monterey and still am not able to get the possibility to use Touch ID in the popup window when I get out of sleep mode. I only have the password option. Any idea why I get this popup window and not the normal screen for getting out of locked screen?

My university card is an NFC card, and I would like to create a duplicate of it. I have tried multiple apps through which I have been able to read it and write other stuff. But I don't know how to write the information contained in my card onto a different tag. Are there any apps on iphone you would suggest for that? Thanks for your time!

I've been using Microsoft Remote Desktop for Mac to connect to a windows machine. I used to be able to redirect a smart card to the remote windows computer. I recently upgraded the RDP app on Mac and now the option to redirect a smart card is greyed out. I've tried removing and re-adding the card but no luck. Has anyone seen this behavior before?

My Mac laptop is running Mojave 10.14.6. I use the PIV Card Smartcard to login and to connect to Cisco VPN and the PIV Card Smartcard shows up correctly in Keychain. Everything works well. After the upgrade from Mojave to Catalina: - I can still use the PIV Card Smartcard to Log In (probably because it cached the credentials). - I do not see the PIV Card Smartcard inside the Keychain app. - I can no longer connect to VPN - it give me certificate errors because I think it can not see the PIV Card Smartcard anymore. Tthis a lab testing laptop. I do have another Mojave laptops that I want to upgrade to Catalina and test the PIV Card Smartcard. Is there any command line or anything other utility which I need to run on the Mojave laptop before the pgrade to Catalina so I won't have issue with my PIV Card Smartcard? I know Catalina changed all the crypto stuff, token, etc. But there must be a command line that I can run that will allow the laptop to still 100% recognize the smart card after the upgrade.

We were setting up to only allow user to login into mac using Yubikey by following this article https://support.apple.com/en-us/HT208372 We are now able to login using Yuibikey but mac still allow to use other method to login (password, fingerprint) has anyone be able to solve this problem?

I have related questions about a smart ID card reader for my MacBook Air. I need to insert a [Smart ID card](https://en.wikipedia.org/wiki/Smart_card) into a reader connected to my laptop when logged into a website for ID verification. I'm a non-technical person and this is freaking me out, but apparently people do this a lot. 1. If I go to a random electronics store and buy a card reader will I have to download and install strange and scary software for the reader to work, or will MacOS already have something built in that will handle this safely? 2. Does Apple make a compatible reader that would be better to use than a random one from a store, where better means some combination of safer, more reliable and more secure? 3. I have an old 2012 MacBook Air but am buying a new 2020 MacBook Air soon. Because of the different connections will I need to buy two different readers? I saw [this answer](https://apple.stackexchange.com/a/33401/143729) to *Easy solution to use a SmartCard with a 15" MacBook Pro?* from 2011 but the item it links to is discontinued.