Limiting SSH to SFTP only?

I use SSH keys to allow passwordless logons to my box. I want to limit them to SFTP only.

I have the following in my authorized_keys file which appears to work:

command="internal-sftp" ssh-rsa ...

I can't seem to find a way around it...but I am no genius...am I actually secure?

I think the proper way to configure this would be to add ForceCommand internal-sftp to the specific user section on sshd_config

Subsystem sftp internal-sftp

Match User MyUser
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    ForceCommand internal-sftp
    ChrootDirectory /home/MyUser

not really. One can just download the authorized_keys file, edit it removing the command="internal-sftp" part and upload it on top of yours and then ssh into the box.