Hacker News Reader

You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had.

Do you have a strong opinion on `on` vs `fixed` ? I tell myself that I should use fixed but haven't bitten the bullet yet.

View on HN

I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.

I have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin.

Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.

Reply on news.ycombinator.com