YHK - yet another hacker news clone

Setting Up SSH Keys on macOS with Touch ID

24 points civilchaos 3 hours ago 16 comments

ggm 3 hours ago | parent

If you do this, have at least one backup key (if need be on paper) or a guaranteed alternate path into the hosts you depend on this key to access. Because if the secure enclave is as good as we're told, if you lose access to ->THIS<- secure enclave, its game over for the keys.

Secure enclave protecting Keychain, the keychain is backed up. Not the contents of the enclave.

Too many failed access attempts? poof the key is gone. Could be as low as 10.

(happy to be corrected. This is what I gather from a quick read-around. I was a bit surprised the site didn't seem to discuss this)

solatic 42 minutes ago | parent

Your backup key should also be in a secure enclave, just in a different secure enclave. Both keys should be accepted by the system.

The truly paranoid can multiple types of secure enclaves - TouchID for primary, a YubiKey for backup.

> If need be on paper

Your security is only as strong as its weakest link. Paper has a way of getting photographed, and the privacy of your key depends on your OCR software, unless you really want to painstakingly copy it in by hand, and even then, it turns into a file-based key on the filesystem, with all its attendant risks.

maratc 1 hour ago | parent

> No key files (like ~/.ssh/id_ed25519.pub and friends) littering the file system; and there’s no risk of mistakenly deleting them either.

Or backing them up, or copying them to your new computer. You're just one spilled coffee cup away from losing the key.

jiehong 1 hour ago | parent

Yes, this only works if you can register more than 1 ssh keys on the services you want.

elmcrest 1 hour ago | parent

happy 1Password user since years, provides this too and you'll have you ssh keys in the 1P keychain (yes, not open source, I know - only flaw imho)

lmz 1 hour ago | parent

That would make it extractable and syncable to other hosts. That's fine if that's what you want but it's an important distinction.

elmcrest 1 hour ago | parent

yes, that's exactly what I want :) (and the private key is only living inside 1Password and isn't extractable from there)

mercutio2 51 minutes ago | parent

You’re mistaken. 1Password syncs keys. Therefore, they’re extractable.

LetMeLogin 30 minutes ago | parent

I am doing the same, such a great underrated feature that many people do not know of.

vr46 1 hour ago | parent

As cool as this is, this does limit the functionality of your keys, because not everything can access the secure enclave in the way it wants to - and as others point out, this is a one-way street and locks your mac hardware into the flow.

I went with this system for some months but it ultimately broke my workflow. I switched to a system of my own devising, in which my local security key decrypts the SSH keys I require.

QGQBGdeZREunxLe 40 minutes ago | parent

Sounds complicated. Just install https://secretive.dev/

Puts 7 minutes ago | parent

It's literately TWO shell commands? One for generating the key in the secure enclave and one for adding it to ssh-agent?

apimade 24 minutes ago | parent

Crazy that this particular feature we’ve all been waiting for hasn’t received first-party support by any DevEx company.

You know, the companies that say security is their number one priority, or companies that scream “developers, developers, developers”. How Google and Apple didn’t come up with something together eludes me, but then again, we have entire ecosystems and categories deployed in the areas they don’t service (auth, application control, etc).