News for hackers. Stuff that matters.

A comment on Post-mortem and remediations for the Matrix.org security breach. Parent comment

Re:Post-mortem and remediations for the Matrix.org security ... by JoachimSchipper on Thursday May 09, 2019 @01:21AM (#19865618)
ssh-agent has prompting and you can set up a Yubikey with ssh.

The problem here was agent forwarding, which you should almost always replace with opening a new connection via ssh -J (or equivalent.)

[ Parent | on HN ]
Re:Post-mortem and remediations for the Matrix.org security ... by voltagex_ on Thursday May 09, 2019 @01:50AM (#19865731)
But can I prompt every time the agent is used?
[ Parent | on HN ]
Re:Post-mortem and remediations for the Matrix.org security ... by Arathorn on Thursday May 09, 2019 @01:56AM (#19865750)
How would you know whether the agent is being used by a legitimate app or a malicious app racing with a legitimate app to steal access?

At least you only would leak a single access, and you would have a higher chance of noticing, but I can also see that if the hijack was done intermittently you might write it off as a glitch...

[ Parent | on HN ]
Re:Post-mortem and remediations for the Matrix.org security ... by jkire on Thursday May 09, 2019 @08:27AM (#19867617)
Yup, if you're using ssh-agent (as opposed to something like gnome-keyring) setting `AddKeysToAgent confirm` to your ssh config should cause a pop up to happen every time anything requests a key from the agent.
[ Parent | on HN ]