alt Hacker NewsI'd suggest to use ssh keys inside the secure enclave on macOS that require your fingerprint for every new session [0]. That way agents cannot initiate anything, and you will always be aware when a new ssh connection is being made.
[0]: https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb...
Replies
causal • today at 2:18 PM
1Password also supports this BUT that does not prevent your agent from being forwarded and you still have to inspect each command being used if you don't trust your agent.
Halfway better would be a separate key for each concern, then check that the key you expect to be used is being used before authorizing.
france_france • today at 2:24 PM
[flagged]
Or in a Yubikey and set the touch-required mechanism (light in the key will blink when it needs a touch to continue the auth).