3 ms·
AFAIK "secretive" SSH agent is not actually running inside SEP when it using the keys. So when keys are actively used they are exposed in main OS RAM and only p
by SXX 1y ago
AFAIK "secretive" SSH agent is not actually running inside SEP when it using the keys. So when keys are actively used they are exposed in main OS RAM and only protected by macOS security model (so are safe unless there is jailbreak / actual root exploit).
So "secretive" and similar software is not as secure as let's say hardware token.
If I'm wrong please correct me, but when I researched the topic I come to this conclusion.
- cyberax 1y agoAh, I see that Secretive is a victim of feature creep. I think it still can use the SE to store the private key, but it also has more ways to do it. This is the initial inspiration for Secretive: https://github.com/sekey/sekey https://github.com/sekey/sekey - it uses the SE to generate and store the actual private key, so it never leaves the machine. Hence its limitations.
- SXX 1y agoAgain - I could be really wrong about Secretive. Sadly their documentation dont make it very clear and I myself don't have enough time to actually to go read the code and figure out how it works exactly.