Re:Protecting SSH Keys with macOS Secure Enclave
by chicagobuss on Wednesday November 11, 2026 @01:34AM
(#50450339)
was wondering the exact same thing. dude never heard of passphrases?
Re:Protecting SSH Keys with macOS Secure Enclave
by Gigachad on Wednesday November 11, 2026 @01:41AM
(#50450366)
Secure Enclave is still more secure in that it should be impossible to access the private key. Password protected keys are still vulnerable to malware that can read the keyboard, trick you in to typing the password, or that have exploits in macOS to read the memory.
Re:Protecting SSH Keys with macOS Secure Enclave
by AlexandrB on Wednesday November 11, 2026 @09:05AM
(#50453581)
If you have malware that can read the keyboard, can't it just inject code via the keyboard to add their own authorized key to whatever server you're connecting to?
Re:Protecting SSH Keys with macOS Secure Enclave
by palata on Wednesday November 11, 2026 @10:18AM
(#50454465)
It is a different attack, though, that is not stealing your key.
Re:Protecting SSH Keys with macOS Secure Enclave
by Jakob on Wednesday November 11, 2026 @01:47AM
(#50450391)
Isn’t the macOS keychain user-readable by default?
Assuming the attacker has user rights (which it needs to read the key) it could also read the passphrase, right?
Re:Protecting SSH Keys with macOS Secure Enclave
by mjg59 on Wednesday November 11, 2026 @02:36AM
(#50450718)
Do you type your passphrase every time you log into a remote machine? If not, the private key is in RAM and can be extracted by malware and stolen. If so, that's way more annoying than using touchid or some other physical proof of presence.
Re:Protecting SSH Keys with macOS Secure Enclave
by elmimmo on Wednesday November 11, 2026 @03:14AM
(#50450894)
I used to install ssh_locker [1] (I don’t know if it still works), and have the passphrase in a keychain separate from the default `login` that I then set in Keychain Access to autolock after a set period of time. Handy for keeping the private key for a while in RAM and then autoremoved, instead of having it there for the whole session. It worked transparently and is a feature that should come with the OS.
Re:Protecting SSH Keys with macOS Secure Enclave
by elmimmo on Wednesday November 11, 2026 @03:34AM
(#50451007)
ChatGPT says ssh_locker locked the keys with `ssh-add -x` which doesn’t necessarily remove them from RAM. Duh! It does point to suggested minimal changes to its source code to effectively accomplish that though.
Re:Protecting SSH Keys with macOS Secure Enclave
by oasisaimlessly on Wednesday November 11, 2026 @12:54PM
(#50456291)
Being able to extract a private key from ssh-agent's PR_SET_DUMPABLE=0 process would be a kernel bug; if you're sitting on such a vulnerability, please consider reporting it.
Re:Protecting SSH Keys with macOS Secure Enclave
by mjg59 on Thursday November 12, 2026 @01:27AM
(#50463740)
So the malware modifies your environment to LD_PRELOAD something into ssh-agent instead on your next login? Stuff that runs inside your own session is inherently vulnerable to malware inside that, even if ptrace protections are a speedbump.
Re:Protecting SSH Keys with macOS Secure Enclave
by tiberious726 on Wednesday November 11, 2026 @05:41AM
(#50451863)
Key on disk plus a passphrase is still only 1FA. Key in the SE + an unseal PIN is 2FA. There's already plenty written about why one is better better than the other.
The author says he doesn’t like the idea of having keys sitting on his file system ready to be snatched by bad actors.
That’s why they should be passphrase protected.
You use ssh agent to store the keys in memory and for convenience you can store the passphrases in keychain. MacOS OpenSSH has the UseKeychain config directive for that.
I use Yubikey/FIDO2 myself, but not because private keys cannot be protected on a file system.