+1 Great find.

I don't know what use-case necessitated including `-A` in one of my aliases (realistically, probably ignorance); given all the other painstaking measures I take, I don't need it at all.

I'd like to not further incriminate myself w.r.t. the gory details of my rookie mistakes and will just end on an expression of gratitude for seeing this make the front page.

Thanks to the submitter and author.

Just don't use SSH keys at all. Anywhere.

https://substack.com/@rakkhi/note/c-40163543?r=1afqp

That's shortsighted. Why not go all the way and just stop using computers altogether?

Huh? So what should we use to e.g. SSH to a server to debug a crashed or hanging process, login to a dev instance etc.?

SSH keys are also not “just long passwords” at all.

Not using SSH to configure a machine is smart, but saying no SSH at all is not feasible for many things. When something goes wrong, you need to be able to connect to a running machine and poke around, and you don’t know how you will need to poke until you are doing it.

The statement "SSH keys are just long passwords" in your linked post is a huge red flag that you don't understand enough about how they work and are in no position to dispense advice (that anyone sane should heed) on the subject.

To start (but it would be a longer discussion), passwords can be captured as you type them into a compromised host, SSH keys can't. Also SSH keys can reside on a security device (TPM, smartcard, HSM, security token, whatever) and this way they can _never_ be captured, barring exploits on those hardware devices, even if your workstation is compromised. Some hardware security devices have features like touch-to-authorize, or even biometrics, for every single usage. SSH keys can be _used_ while unlocked, but not from a compromised remote site (unless you do agent forwarding, which this article is all about), and never captured from there. Passwords have literally _none_ of the above features.

Forwarding usually bad. SSH Keys otherwise good. Passwords so bad they're not worth comparing to anything.

(and yeah, there's stuff even better than SSH keys)

Agent confirmations don’t need local authentication really; local confirmation is what’s important here.