Re:ChatGPT Desktop forwards your SSH agent to remote machines
by hgoel on Monday November 09, 2026 @11:33AM
(#50427877)
I think it's always worth bringing up the risk of 'confirmation fatigue' in these kinds of discussions. Friction is not universally good for security. Too much friction and your users start blindly confirming everything instead of reading/thinking. This is already a problem with LLM tool calls (due to which, everyone seems to be pushing towards an 'allow all, with some exceptions' type model).
[ Parent
| on HN ]
Re:ChatGPT Desktop forwards your SSH agent to remote machines
by cyanydeez on Monday November 09, 2026 @11:44AM
(#50428036)
it took NIST a decade to realize that constantly making users change passwords for no other reason but the wall clock changed increased the use of insecure password practices.
It is indeed a world of reality vs what sounds good on paper.
Re:ChatGPT Desktop forwards your SSH agent to remote machines
by 1broseidon on Monday November 09, 2026 @04:36PM
(#50432561)
Friction is good when it serves a security purpose, not for its own sake. Too much of it and users either stop using the thing or find ways around it, which is arguably worse - as you pointed out!
To have LESS friction you need MORE signals, ones that add up to "this action is low risk, proceed" as a cumulative risk score. Kind of like credit card transactions... most transactions go through silently because the issuer scores them on merchant, amount, device and history, and you only get the step-up prompt when the score is off.
"Manual Approval" and "Bypass Everything" are both what you ship when you have no signals.