YHK - yet another hacker news clone

Protecting SSH Keys with macOS Secure Enclave

46 points js2 1 hour ago 10 comments

cavoirom 59 minutes ago | parent

If someone like the native approach or is familiar with SeKey, I created sekey-sh to simplify the process: https://github.com/cavoirom/sekey-sh

Work on macOS 26 and later.

Gigachad 47 minutes ago | parent

I was looking in to this just earlier today. The native macos version worries me a little because it seems someone just happened to discover it in MacOS, rather than it being a documented feature. The worry being Apple could change or remove it later locking you out of your keys since they never advertised this as a thing you could do.

cavoirom 36 minutes ago | parent

It is the same as you lost your device. You must have a second backup key, and treat one in Secure Enclave as disposable key.

bdamm 44 minutes ago | parent

We should have had this 20 years ago. It is almost pathological how difficult it is to reliably use hardware keys as ssh credentials.

petesergeant 38 minutes ago | parent

I've been using Secretive (a nice software wrapper for these) for a few days for my Github keys (where 1Password holds the rest of my SSH keys). It works nicely, but obviously you can't back up a key that started life in a secure enclave, so you'll need alternative access arrangements for anything you setup that way.

larusso 34 minutes ago | parent

I used yubikeys for ssh for years. First via the older clunky gpg as ssh key feature. Then via the FIDO api. My biggest issue was the chicken and egg issue when using this setup on a new machine or god forbid in a container etc. windows and WLS wasn’t super thrilled either. I switched to 1Password ssh because I actually like the fact that I can simply share my keys. It’s still not perfect. Agent forwarding needs an extra configuration and depending how many keys you have and how verbose your ssh config gets it becomes also very finicky. This solution feels for me like a slight setback because it’s a macOS only solution. If you have a Linux or windows machine next to a Mac you have to deal with the insecure key file on your hard drive again either via yubi keys or software solutions.

But I think I would take this over a yubikey. I really disliked the fact that one usb port was constantly in use.

nubb 22 minutes ago | parent

you can’t just pop it out once you’re logged in?

larusso 5 minutes ago | parent

Sure and pop in whenever I do a git commit? I also sign my commits. I used GPG (different key on the same hardware key) and now via SSH key. I had both a compact and bigger key. I got the compact key because my very first yubikey nearly broke. I lifted my Mac while it was connected and it cracked in the middle. I bought a compact one next which can stay inside and that one you don’t want to take out. It’s so small you’ll lose it. I know because that happened to my backup key … (that was actually the idea for the bigger one I bought but I lost the damn thing during the setup phase) But having the yubikey bound to your Mac at all times is also stupid because it doesn’t come with a fingerprint or other biometric sensor. The idea is that you use this thing as a token not that you leave the key in the lock at all times. For that alone I would favor the enclave solution.

dsenkus 18 minutes ago | parent

These days I'm mainly doing development inside VM's. Previously I was embedding Github key to each VM, but since I setup Secure Enclave (with Secretive), I'm only forwarding it's agent to VM and each git action on origin now requires approval using fingerprint reader. I think this a good way to prevent malware from gaining access to github

database64128 4 minutes ago | parent

Security features like this works, until it doesn't.

When I installed WireGuard on macOS, I was happy to discover that it stores private keys in the system keychain. Accessing the private key requires Touch ID.

Then one day after a system upgrade, the WireGuard app crashed on startup with:

  [APP] Unable to open config from keychain: -25300
Then the app deleted all profiles because they are all "orphaned", apparently for "keychain consistency" [0].

From then on, I just use a text editor to edit my WireGuard configuration files, and import them to the app. The bug still exists to this day [1].

[0] https://github.com/WireGuard/wireguard-apple/commit/dfb685f2...

[1] https://www.reddit.com/r/WireGuard/comments/wyt828/osx_wireg...