Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by dsenkus on Wednesday November 11, 2026 @12:30AM (#50450027)

These days I'm mainly doing development inside VM's. Previously I was embedding Github key to each VM, but since I setup Secure Enclave (with Secretive), I'm only forwarding it's agent to VM and each git action on origin now requires approval using fingerprint reader. I think this a good way to prevent malware from gaining access to github

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by LeBit on Wednesday November 11, 2026 @01:23AM (#50450280)

Why not use PAT?

I’ve grown to appreciate ssh should only be used with git for signing commits and as a deploy key (eg in a CI system).

I always use https for day to day git operations. My keys reside in gopass and are extracted by gopass-git-credential when needed by git.

I use that within devcontainers

https://github.com/gopasspw/git-credential-gopass

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by Gigachad on Wednesday November 11, 2026 @01:43AM (#50450375)

Those access token can still be stolen just the same. The Secure Enclave is better because you can ask it to authorise the action, but you can never get the key out of it, so the latest malicious npm package can’t send off your access tokens or ssh keys.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by dsenkus on Wednesday November 11, 2026 @02:37AM (#50450719)

absolute security does not exist, but each small improvement adds up. I quite like having to authorize each remote git action with Touch ID.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by Jakob on Wednesday November 11, 2026 @01:50AM (#50450402)

PAT are vulnerable, once stolen they can be used from anywhere until their (usually) long term expiry.

Better use short lived tokens with auto refresh. For example OAuth tokens. They can be used for the same use cases like PAT, but they expire after a max of 2 hours.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by masklinn on Wednesday November 11, 2026 @02:15AM (#50450563)

Which oauth tokens are you talking about? Because GitHub’s created by oauth or gh apps have a lifetime of either 8h or forever.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by Jakob on Wednesday November 11, 2026 @02:56AM (#50450809)

Gitlab uses 2h. TIL that GitHub uses 8h.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by eddythompson80 on Wednesday November 11, 2026 @03:55AM (#50451123)

2 hours is plenty. The recent binance hack was 20 minutes after all. A 2 hour token is enough time to get all that can be gotten or done by a token in almost any system especially well defined ones like GH or GL.

It would be nice if GitHub or GitLab could limit a token to a given IP, but with how proxies and dynamic ips work I would imagine it would be a hassle to get it working correctly for everyone, but it’s better than nothing.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by yangm97 on Wednesday November 11, 2026 @05:07AM (#50451618)

IP prefix should be enough to narrow down to your ISP + rough geographic location. Not perfect but requires no extra setup.

[ Parent | on HN ]