5 ms·

Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https

Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https://github.com/sekey/sekey https://github.com/sekey/sekey)

tn1 6y ago
Does anyone know of the TPM equivalent for this? I found this [1] but when I tried it, the Windows Hello prompt only accepts USB security keys and not the fingerprint sensor in my laptop (already set up for login). My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also. [1] https://github.com/tavrez/openssh-sk-winhello https://github.com/tavrez/openssh-sk-winhello
pram 6y ago
Secretive also does this, and works on any Mac with the T2. I use it for all my ssh keys these days. It’s super slick! https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
8fingerlouie 6y ago
So if your mac dies, you effectively lock yourself out of any servers ? Or do you have a backup key ? If so, how do you protect that ? Not criticizing, just genuinely interested in how to best manage keys.
- GekkePrutser 6y ago
  You can always add more authorized keys.. That's what I do and definitely the way to go for this scenario.
  - archi42 6y ago
    With ssh the situation is quite good, and it should serve as an example on "how to do it right". I find web services to be a huge pain, though: Obviously most don't offer any kind of 2FA, or maybe Google Authenticator or SMS at best (which means those websites must be so bad that people don't login to it on their phone?). But even those who do "proper" 2FA often will only allow a single U2F token - and enforce GA, SMS or a secondary email as fallback. (Putting this rant here so maybe a webdev or even two do it better the next time they do some auth stuff ;-))
- lucideer 6y ago
  > do you have a backup key ? You should always have keys per device (as has been discussed in other comments here). So if you have >1 device, you'll automatically have backups. > If so, how do you protect that ? While it may seem bad to have some keys less securely protected than others, the ability to revoke a single device means that using Yubikey / Secure Enclave / whatever on one device is still better than using them on none.

tn1 6y ago

Does anyone know of the TPM equivalent for this? I found this [1] but when I tried it, the Windows Hello prompt only accepts USB security keys and not the fingerprint sensor in my laptop (already set up for login). My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also. [1] https://github.com/tavrez/openssh-sk-winhello https://github.com/tavrez/openssh-sk-winhello

pram 6y ago

Secretive also does this, and works on any Mac with the T2. I use it for all my ssh keys these days. It’s super slick! https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive

8fingerlouie 6y ago

So if your mac dies, you effectively lock yourself out of any servers ? Or do you have a backup key ? If so, how do you protect that ? Not criticizing, just genuinely interested in how to best manage keys.

GekkePrutser 6y ago
You can always add more authorized keys.. That's what I do and definitely the way to go for this scenario.
- archi42 6y ago
  With ssh the situation is quite good, and it should serve as an example on "how to do it right". I find web services to be a huge pain, though: Obviously most don't offer any kind of 2FA, or maybe Google Authenticator or SMS at best (which means those websites must be so bad that people don't login to it on their phone?). But even those who do "proper" 2FA often will only allow a single U2F token - and enforce GA, SMS or a secondary email as fallback. (Putting this rant here so maybe a webdev or even two do it better the next time they do some auth stuff ;-))
lucideer 6y ago
> do you have a backup key ? You should always have keys per device (as has been discussed in other comments here). So if you have >1 device, you'll automatically have backups. > If so, how do you protect that ? While it may seem bad to have some keys less securely protected than others, the ability to revoke a single device means that using Yubikey / Secure Enclave / whatever on one device is still better than using them on none.