For simpler tasks, I find adminer works very well: http://www.adminer.org/ Installation is as easy as uploading a single file. One advantage of that is you can mitigate any security risk by simply adding "die;" to the top of the file when you don't need it.

SSH tunneling from your desktop to your MySQL host and connecting you admin client through that should alleviate the concerns around exposing 3306 to the world.

The most secure setup for administrative services is to whitelist their ports by IP address. For example port 22 (SSH) on our servers can only be hit by known-good IP addresses. You can do the same for MySQL's port, or use an SSH tunnel to hit MySQL through localhost.

Restricting SSH to "known-good" IP addresses is less flexible and less secure than public key authentication.

(Restricting mysql access to localhost and using an SSH tunnel is fine practice, AFAIK.)

It is less flexible, but it is more secure than using public key authentication by itself (public key auth can be used in conjunction with an IP whitelist).

I'm not sure an IP whitelist gives you anything -- it provides a handy mechanism for escalating privileges, both for intrusions on a machine at the "known-good" IP and for unintended network access in general.

Um. No. Bouncing traffic through one device out of probably many at your house (when's the last time you updated the firmware on your TV? Your router?) is a lot more feasible than breaking public key encryption.

I don't use MySQL anymore and I use command line clients everywhere. But that wasn't the point.

Also, sequel (rubygem) comes with an awesome console to write SQL queries in.

personally ( = db amateur) I like this a lot: https://code.google.com/p/sqlyog/downloads/list

MySQL CLI via SSH or MySQL Workbench.