Protecting SSH Keys with macOS Secure Enclave(gatezh.com)
51 pointsby js2an hour ago8 comments
  • database6412812 minutes ago
    Security features like this works, until it doesn't.

    When I installed WireGuard on macOS, I was happy to discover that it stores private keys in the system keychain. Accessing the private key requires Touch ID.

    Then one day after a system upgrade, the WireGuard app crashed on startup with:

      [APP] Unable to open config from keychain: -25300
    Then the app deleted all profiles because they are all "orphaned", apparently for "keychain consistency" [0].

    From then on, I just use a text editor to edit my WireGuard configuration files, and import them to the app. The bug still exists to this day [1].

    [0] https://github.com/WireGuard/wireguard-apple/commit/dfb685f2...

    [1] https://www.reddit.com/r/WireGuard/comments/wyt828/osx_wireg...

  • dsenkus26 minutes ago
    These days I'm mainly doing development inside VM's. Previously I was embedding Github key to each VM, but since I setup Secure Enclave (with Secretive), I'm only forwarding it's agent to VM and each git action on origin now requires approval using fingerprint reader. I think this a good way to prevent malware from gaining access to github
  • larusso41 minutes ago
    I used yubikeys for ssh for years. First via the older clunky gpg as ssh key feature. Then via the FIDO api. My biggest issue was the chicken and egg issue when using this setup on a new machine or god forbid in a container etc. windows and WLS wasn’t super thrilled either. I switched to 1Password ssh because I actually like the fact that I can simply share my keys. It’s still not perfect. Agent forwarding needs an extra configuration and depending how many keys you have and how verbose your ssh config gets it becomes also very finicky. This solution feels for me like a slight setback because it’s a macOS only solution. If you have a Linux or windows machine next to a Mac you have to deal with the insecure key file on your hard drive again either via yubi keys or software solutions.

    But I think I would take this over a yubikey. I really disliked the fact that one usb port was constantly in use.

    • nubb29 minutes ago
      you can’t just pop it out once you’re logged in?
      • larusso12 minutes ago
        Sure and pop in whenever I do a git commit? I also sign my commits. I used GPG (different key on the same hardware key) and now via SSH key. I had both a compact and bigger key. I got the compact key because my very first yubikey nearly broke. I lifted my Mac while it was connected and it cracked in the middle. I bought a compact one next which can stay inside and that one you don’t want to take out. It’s so small you’ll lose it. I know because that happened to my backup key … (that was actually the idea for the bigger one I bought but I lost the damn thing during the setup phase) But having the yubikey bound to your Mac at all times is also stupid because it doesn’t come with a fingerprint or other biometric sensor. The idea is that you use this thing as a token not that you leave the key in the lock at all times. For that alone I would favor the enclave solution.
  • Gigachadan hour ago
    I was looking in to this just earlier today. The native macos version worries me a little because it seems someone just happened to discover it in MacOS, rather than it being a documented feature. The worry being Apple could change or remove it later locking you out of your keys since they never advertised this as a thing you could do.
    • cavoirom43 minutes ago
      It is the same as you lost your device. You must have a second backup key, and treat one in Secure Enclave as disposable key.
  • cavoiroman hour ago
    If someone like the native approach or is familiar with SeKey, I created sekey-sh to simplify the process: https://github.com/cavoirom/sekey-sh

    Work on macOS 26 and later.

  • bdamman hour ago
    We should have had this 20 years ago. It is almost pathological how difficult it is to reliably use hardware keys as ssh credentials.
  • petesergeantan hour ago
    I've been using Secretive (a nice software wrapper for these) for a few days for my Github keys (where 1Password holds the rest of my SSH keys). It works nicely, but obviously you can't back up a key that started life in a secure enclave, so you'll need alternative access arrangements for anything you setup that way.
    • johng2 minutes ago
      2nd this. Found out about it when this type of thing came up about a week ago. I had a hard time getting the stock stuff going but Secretive made it easy to set up and I love using it.

      Definitely a recco from me as well. -- git hub here: https://github.com/maxgoedjen/secretive

  • getbrew5 minutes ago
    [flagged]