This is why I haven't bothered with smartcards. If you login from a compromised desktop, it's pretty much over, even with a smartcard. There is no real way ar

This is why I haven't bothered with smartcards. If you login from a compromised desktop, it's pretty much over, even with a smartcard. There is no real way around the evil maid attack. If I login from a compromised computer, if that computer is compromised by a competent attacker, it's over. The advantage of a smartcard, if and only if you've got a smartcard that requires some action to authenticate (like a physical pin pad) is that only the servers I've logged into while compromised are compromised (assuming you don't have some kind of jelly doughnut setup where all servers can login to all other servers) whereas if I have an encrypted private key, well, if I decrypt it while the attacker is on the box, the attacker has compromised /all/ servers I have a login on.