Hacker News Reader

Comment by InsidiousWombat | Hacker News Reader

you can make your SSH agent do that, no need to use bitwarden.

If you're using say yubikey for hardware ssh key (via gpg ssh agent/smartcard interface) you can also make it require physical touch of the key to confirm every operation

View on HN

Plus, if you're using the Yubikey for hardware SSH, you can't use the Bitwarden SSH agent anyway. It just isn't compatible. It's one of my bigger frustrations with its SSH agent feature, as I prefer to have my GitHub SSH key on Bitwarden.

If your machine has a TPM chip you can also use that and require a PIN to unlock it, with a mandatory lock out period enforced by the chip

the biggest issue with the yubikey touch verification is that you have no way of telling what you're verifying, especially if some tool helpfully forwarded your agent, or is trying to maintain ssh connections in the background

first time you see the light blinking without doing anything intentional is a bit of a sinking feeling

How do I do it with touchid and a MacBook Air?

Secretive should do this. It generates a key inside the secure enclave, and you can set it to require TouchID, so you know whenever it's used. Keys can't be exported either.

you can generate a key in the secure enclave then use that with touchid every time to authenticate - see eg. https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-tou...

Reply on news.ycombinator.com