4 ms·
You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had. Do you have a strong opini
by philsnow 8y ago
You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had.
Do you have a strong opinion on `on` vs `fixed` ? I tell myself that I should use fixed but haven't bitten the bullet yet.
- StreakyCobra 8y agoI set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.
- naggie 8y agoI have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin. Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.