Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by anaisbetts on Wednesday November 11, 2026 @08:42AM (#50453320)

Never missing an opportunity for self-promotion, if you use a lot of machines and have issues with agent forwarding and Git (i.e. because you're using a remote coding agent), I wrote https://github.com/anaisbetts/ts-ssh-agent which is more of a security/usability compromise - your keys are stored on a remote Tailscale node, and agent signing requests are verified via your Tailscale identity and gated by Tailscale access rules.

This means the machines you want have access to SSH (i.e. GitHub push/pull), but none of them have an actual SSH key - if a machine is compromised you drop it from Tailscale

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by vr46 on Wednesday November 11, 2026 @09:02AM (#50453565)

Great until Tailscale fails either completely or on that node. I did something similar but this was how it completely broke - once on a Raspberry Pi two metres away and once on a VPS two continents away.

Recoverable via console access but disruptive.

Still using Tailscale but have redesigned my setup and keep coding agents on a short leash. Also switched to internal Forgejo for speed and use GitHub as a push mirror.

I like a lot of the ideas in Tailscale, but I think I adopted too much of it in a fug of excitement and power.

[ Parent | on HN ]