Hacker News Reader

I was considering this but ultimately opted for 1Password’s SSH Agent instead and storing my SSH keys there and unlocking it with Touch ID: https://developer.1password.com/docs/ssh/agent/

Also use it to sign my git commits: https://developer.1password.com/docs/ssh/git-commit-signing

View on HN

I have the same setup and can vouch that it works very well. My primary threat vector is data exfiltration by a compromised binary/node_module. A script reads everything in $HOME and sends it offsite. This is challenging to defend against, considering how many secrets want to live in plain text files (dot files, DB, AWS configs, backups, ssh keys, etc.), and file permissions do not help when the script runs with my user privileges.

Reply on news.ycombinator.com