Secretive – macOS native app to store SSH keys in the Secure Enclave

Re:Secretive – macOS native app to store SSH keys in the Sec... by Hnrobert42 on Sunday June 28, 2020 @03:00AM (#23667175)

There is a native way in .ssh/config. I just added a reply to a different post.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by mfontani on Sunday June 28, 2020 @03:43AM (#23667312)

That only restricts the blast radius to one key.

One is unawares of when, how, and for what purposes that key is used - as forwarding the key means it's available for use by any user process (as the mechanism behind the forwarding is user-owned) or root (as root can see everything).

Touch-to-authorize helps mitigate that.

If one seees the prompt come up when they've just performed a git pull, it's expected and likely non-malicious. Allow.

If it pops up after having ran "ls" or "randomly" in the course of a session - what's going on? Deny.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by Hnrobert42 on Tuesday June 30, 2020 @02:07AM (#23687090)

You are correct. Touch to authorize is lower risk. I don’t know a way to do that natively. Sorry if I misunderstood.

[ Parent | on HN ]