A better summary. [LWN.net]

A better summary.

Posted Jun 10, 2026 8:37 UTC (Wed) by mjg59 (subscriber, #23239)
In reply to: A better summary. by taladar
Parent article: Eliminating long-lived credentials with trusted publishing

At login time, or after first use in a session? It's pretty common for SSH keys to be automatically loaded when you log in, which means they're exposed even if you haven't used them. I don't think this is a terribly important distinction, but it is a distinction.

to post comments

A better summary.

Posted Jun 10, 2026 14:54 UTC (Wed) by mbunkus (subscriber, #87248) [Link]

Personally I use KeepassXC & store the important, root-/admin-level access giving keys there. I have it set to auto-remove those keys from the agent after 2 hours. When I need to use them I add them manually via KeepassXC.

Though that leaves the question if that's actually meaningfully different from having it in the agent all the time — if an attacker can trace my running ssh-agent, it can trace my running KeepassXC.

A better summary.

Posted Jun 12, 2026 22:50 UTC (Fri) by jengelh (subscriber, #33263) [Link]

gpg-agent has `default-cache-ttl` and `max-cache-ttl` (default: 10min/2h). ssh-agent/ssh-add only has -t (equivalent to max-cache-ttl), with a time-unlimited default. That's quite the difference.