4 ms·
On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=4602
by antonkochubey 10mo ago
On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721 https://news.ycombinator.com/item?id=46025721
It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.
- XiS 10mo agoBeen using ed25519-sk with Yubikey for a few years now. Key is stored in KeepassXC and loaded in my SSH agent upon unlock. It makes my SSH key pretty portable across devices
- throwawayqqq11 10mo agoMy approach aswell. Lock down ssh-agent and restrict its usage as much as possible. Securing your keys is also very reasonable but it cant silence this naging voice in the back of my head that keeps reminding me of a compromised ssh-agent or shell, whenever i authorize privileged actions.
- Almondsetat 10mo agoYou can also do something similar with any computer that has a TPM. It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly
- Foxboron 10mo ago> It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly This is my cue. https://github.com/Foxboron/ssh-tpm-agent https://github.com/Foxboron/ssh-tpm-agent
- Sublevel5169 10mo agoThank you for sharing!