Re:Protecting SSH Keys with macOS Secure Enclave
by larusso on Wednesday November 11, 2026 @02:07AM
(#50450515)
Share as in storing my key in 1Password and use it from different machines. I generated the key from 1Password and don’t intend to export it.
Re:Protecting SSH Keys with macOS Secure Enclave
by LeBit on Wednesday November 11, 2026 @06:29AM
(#50452159)
You should reevaluate if you can instead use multiple public keys where you need to connect.
It’s a mind shift worth considering.
You then can accept that your ssh keys are different per hardware token (because the private key cannot be extracted).
No more sharing of private keys in your password manager.
Re:Protecting SSH Keys with macOS Secure Enclave
by larusso on Wednesday November 11, 2026 @03:33PM
(#50458287)
I’m a bit lost and maybe something also got lost in translation. I use 1Password to store multiple ssh keys for different services. I have a very restrictive ssh config because I don’t like to use ssh agent which hands out all keys to different connections. I use one key for a set of machines for work. One for GitHub etc etc etc. I connect to these machines from different endpoints. And I don’t want to register each of these with a new custom keypair to all the services. Like GitHub. I have 1Password installed on all desktops I use so I pull them from there. I share the same dot files and configuration. For GitHub I actually need 3 keys. My private key, 2 for work that have special SSO permissions. I don’t want my private key to have access to the work repos that’s why I split and my company has 2 different enterprise accounts where I have 2 different user accounts.
SSH private keys should be passphrase protected.
You don’t have to do that if you use FIDO2 with a Yubikey.