Hacker News Reader

Yes. ssh-agent prevents non-root users, including the user running ssh-agent[1] from being able to extract the private key. That's much more secure than storing unencrypted keys in ~/.ssh.

[1] ssh-agent uses some tricks, like making itself setgid, and/or using prctl(PR_SET_DUMPABLE, 0) on Linux to make its memory undumpable.

View on HN

That won't prevent your key from being stolen if you leave it on a VM controlled by someone else.

Your key belongs on your personal device, and agent forwarding enables you to behave as if your key is everywhere you need it to be.

And on OSX, it integrates with the keychain as well!

You're better off not storing your passphrase in the keychain and just typing it in that one first time, though. But it's still marginally better than an unencrypted private key for automation if you need a 100% unattended setup.

"In the keychain" doesn't necessarily mean in the login keychain. You can create as many user keychains as you want, with different passwords. Also, add the keychain app to your menubar (via preferences) to get a quick way to manually lock one or all keychains (and alternatively, the whole computer).

Reply on news.ycombinator.com