News for hackers. Stuff that matters.

A comment on ChatGPT Desktop forwards your SSH agent to remote machines. Parent comment

Re:ChatGPT Desktop forwards your SSH agent to remote machines by InsidiousWombat on Monday November 09, 2026 @09:11AM (#50425878)
you can make your SSH agent do that, no need to use bitwarden.

If you're using say yubikey for hardware ssh key (via gpg ssh agent/smartcard interface) you can also make it require physical touch of the key to confirm every operation

[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by tylergetsay on Monday November 09, 2026 @10:16AM (#50426798)
If your machine has a TPM chip you can also use that and require a PIN to unlock it, with a mandatory lock out period enforced by the chip
[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by rolosa on Monday November 09, 2026 @10:18AM (#50426837)
How do I do it with touchid and a MacBook Air?
[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by MSP_Logic on Monday November 09, 2026 @12:57PM (#50429001)
Secretive should do this. It generates a key inside the secure enclave, and you can set it to require TouchID, so you know whenever it's used. Keys can't be exported either.
[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by concretebush on Monday November 09, 2026 @01:12PM (#50429229)
you can generate a key in the secure enclave then use that with touchid every time to authenticate - see eg. https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-tou...
[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by hgoel on Monday November 09, 2026 @11:53AM (#50428172)
Plus, if you're using the Yubikey for hardware SSH, you can't use the Bitwarden SSH agent anyway. It just isn't compatible.
[ Parent | on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines by alsdkgjhgd on Monday November 09, 2026 @06:21PM (#50433797)
the biggest issue with the yubikey touch verification is that you have no way of telling what you're verifying, especially if some tool helpfully forwarded your agent, or is trying to maintain ssh connections in the background

first time you see the light blinking without doing anything intentional is a bit of a sinking feeling

[ Parent | on HN ]