Hacker News Reader

Comment by Lukas_Skywalker | Hacker News Reader

The Bitwarden desktop app has a built in SSH agent [1], which lets you store SSH keys inside Bitwarden. I have set the app to always ask me for confirmation when the key is requested.

[1] https://bitwarden.com/help/ssh-agent/

View on HN

you can make your SSH agent do that, no need to use bitwarden.

If you're using say yubikey for hardware ssh key (via gpg ssh agent/smartcard interface) you can also make it require physical touch of the key to confirm every operation

Plus, if you're using the Yubikey for hardware SSH, you can't use the Bitwarden SSH agent anyway. It just isn't compatible. It's one of my bigger frustrations with its SSH agent feature, as I prefer to have my GitHub SSH key on Bitwarden.

If your machine has a TPM chip you can also use that and require a PIN to unlock it, with a mandatory lock out period enforced by the chip

the biggest issue with the yubikey touch verification is that you have no way of telling what you're verifying, especially if some tool helpfully forwarded your agent, or is trying to maintain ssh connections in the background

first time you see the light blinking without doing anything intentional is a bit of a sinking feeling

How do I do it with touchid and a MacBook Air?

Secretive should do this. It generates a key inside the secure enclave, and you can set it to require TouchID, so you know whenever it's used. Keys can't be exported either.

you can generate a key in the secure enclave then use that with touchid every time to authenticate - see eg. https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-tou...

Himitsu's ssh-agent does the same, and if you use some agent that uses a secret-service backend, you'd get the same result.

It's mostly the default ssh-agent that has a different security model.

1Password too, FWIW

As well as KeepassXC

Reply on news.ycombinator.com