News for hackers. Stuff that matters.

A comment on Protecting SSH Keys with macOS Secure Enclave. Parent comment

Re:Protecting SSH Keys with macOS Secure Enclave by Jakob on Wednesday November 11, 2026 @01:50AM (#50450402)
PAT are vulnerable, once stolen they can be used from anywhere until their (usually) long term expiry.

Better use short lived tokens with auto refresh. For example OAuth tokens. They can be used for the same use cases like PAT, but they expire after a max of 2 hours.

[ Parent | on HN ]
Re:Protecting SSH Keys with macOS Secure Enclave by masklinn on Wednesday November 11, 2026 @02:15AM (#50450563)
Which oauth tokens are you talking about? Because GitHub’s created by oauth or gh apps have a lifetime of either 8h or forever.
[ Parent | on HN ]
Re:Protecting SSH Keys with macOS Secure Enclave by Jakob on Wednesday November 11, 2026 @02:56AM (#50450809)
Gitlab uses 2h. TIL that GitHub uses 8h.
[ Parent | on HN ]
Re:Protecting SSH Keys with macOS Secure Enclave by eddythompson80 on Wednesday November 11, 2026 @03:55AM (#50451123)
2 hours is plenty. The recent binance hack was 20 minutes after all. A 2 hour token is enough time to get all that can be gotten or done by a token in almost any system especially well defined ones like GH or GL.

It would be nice if GitHub or GitLab could limit a token to a given IP, but with how proxies and dynamic ips work I would imagine it would be a hassle to get it working correctly for everyone, but it’s better than nothing.

[ Parent | on HN ]
Re:Protecting SSH Keys with macOS Secure Enclave by yangm97 on Wednesday November 11, 2026 @05:07AM (#50451618)
IP prefix should be enough to narrow down to your ISP + rough geographic location. Not perfect but requires no extra setup.
[ Parent | on HN ]