On Monday, 18 July 2022 08:03:44 CEST Grant Taylor wrote: > On 7/17/22 11:48 PM, J. Roeleveld wrote: > > It could, but that would open up an unsecured key to interception if > > an intermediate host is compromised. > > What are you thinking? -- I've got a few ideas, but rather than > speculating, I'll just ask.
See below > > See previous answer, the agent, as far as I know, will have the keys > > in memory and I haven't seen evidence that it won't provide the keys > > without authenticating the requestor. > > Are you concerned about a rogue requestor on the host where the agent is > running or elsewhere? Either on the client where the agent is running, but also on the system I connected to. But, I just noticed the following, which is hopeful, but need to read up on this: https://www.openssh.com/agent-restrict.html[1] > > Yes, copy/paste has no issues with multi-page texts. But manually > > reading a long password and copying that over by typing on a keyboard > > when the font can make the difference between "1" (ONE), "l" (small > > letter L) and "|" (pipe- character) and similar characters make it > > annoying to say the least. > > Agreed. > > > Currently, when that comment pops up, the first thing I do is wait > > and wonder why it's asking for it. As all the systems are already > > added to the list. > > Such a pop-up would be a very likely indication of a problem. Agreed, which is why I always stop and think when I see that. Usually the answer is: "Oh, yes, I didn't access this host from my laptop yet". But that is usually after the 2nd or 3rd connection attempt with retyping the hostname and verifying the IP-address that is resolved for it first. -- Joost -------- [1] https://www.openssh.com/agent-restrict.html
