3 ms·

Maybe but this is unexpected if you need to restore from a backup..

by winstonwinston 15d ago

__MatrixMan__ 15d ago
Don't backup keys, rotate them.
- gavinsyancey 15d ago
  I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.
  - __MatrixMan__ 15d ago
    Yeah, that's why secure enclaves embedded in complex devices are a bad idea. Hardware keys are the way: - Less likely to fail in the first place - Cheap enough to have several of so you can use one to log in and manage the others in the event of loss - Easy to move between devices - Less likely to use the auth handshake as a side channel for things you didn't consent to
    - pmontra 15d ago
      Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors. My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
      - mingus88 14d ago
        I have a few yubikeys and it’s a manual process to sync a new key last time I tried I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one. It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
        __MatrixMan__ 14d ago
        Yeah it feels pretty dumb to have to register all of my keys with each service, but as far as I can tell it's the least dumb thing.
petronic 15d ago
I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.
- lapcat 15d ago
  Migration Assistant uses the old Mac, which can unlock its login keychain and allow the keychain items to be copied.
  - pmontra 15d ago
    What if the old Mac is dead, stolen, lost? Those are the scenarios in which one recovers on a new machine from a backup.
    - lapcat 15d ago
      Then you're in trouble.
    - awakeasleep 15d ago
      What information from your login keychain do you expect to need on your new computer? There's not really a plausible answer to that question, because the login keychain data is almost entirely specific to that host. To iron-man your argument: Apps that store account credentials to third party services will need to be signed in again. If you were using http basic auth for a website and saving that, then it was probably in there. Private keys and certificates you manually imported, or that were created by an application for your host. This is the closest to a plausible answer, imo.
      - kelnos 14d ago
        > What information from your login keychain do you expect to need on your new computer? Pretty much everything?
  - Angostura 15d ago
    Migration assistant can also use a TM backup, I’m pretty sure
ryandrake 15d ago
It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
- GeekyBear 15d ago
  > As a general principle, as a user, I expect a file on one computer to be usable on another computer. As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s). > if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. You can export your passwords to a plain text CSV from the original computer.
  - ftchd 15d ago
    As a general rule, if I'm the user of both disks I expect to have the encryption key(s).
  - shaky-carrousel 15d ago
    As a general rule, I expect a file on an encrypted disk to be encrypted with a key derived from a password I provide.
    - wtallis 15d ago
      I think it's time to update your expectations. Hardware security modules have been around for quite a while. You shouldn't assume that your chosen password is the only input to the key derivation, or even that the raw key itself will always be obtainable.
      - shaky-carrousel 15d ago
        I never assumed that my chosen password was the only input to the key derivation. Just that my chosen password is at least one of the inputs to the key derivation. LUKS has been around for quite a while.
wl 15d ago
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue. Use iCloud Keychain or don't use Keychain at all.
- frizlab 15d ago
  Or create a separate keychain db and use that. The encryption is only done for the login keychain.
- adastra22 14d ago
  I've learned to not trust Apple support on anything. My daughter's Watch screen cracked and we sent it in for a replacement. To setup the replacement though, they requried that she unpair then repair the watch then-and-there. They said she wouldn't lose any data, that it just disconnected it from the phone. Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.

Maybe but this is unexpected if you need to restore from a backup..

__MatrixMan__ 15d ago

Don't backup keys, rotate them.

gavinsyancey 15d ago
I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.
- __MatrixMan__ 15d ago
  Yeah, that's why secure enclaves embedded in complex devices are a bad idea. Hardware keys are the way: - Less likely to fail in the first place - Cheap enough to have several of so you can use one to log in and manage the others in the event of loss - Easy to move between devices - Less likely to use the auth handshake as a side channel for things you didn't consent to
  - pmontra 15d ago
    Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors. My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
    - mingus88 14d ago
      I have a few yubikeys and it’s a manual process to sync a new key last time I tried I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one. It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
      - __MatrixMan__ 14d ago
        Yeah it feels pretty dumb to have to register all of my keys with each service, but as far as I can tell it's the least dumb thing.

petronic 15d ago

I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.

lapcat 15d ago
Migration Assistant uses the old Mac, which can unlock its login keychain and allow the keychain items to be copied.
- pmontra 15d ago
  What if the old Mac is dead, stolen, lost? Those are the scenarios in which one recovers on a new machine from a backup.
  - lapcat 15d ago
    Then you're in trouble.
  - awakeasleep 15d ago
    What information from your login keychain do you expect to need on your new computer? There's not really a plausible answer to that question, because the login keychain data is almost entirely specific to that host. To iron-man your argument: Apps that store account credentials to third party services will need to be signed in again. If you were using http basic auth for a website and saving that, then it was probably in there. Private keys and certificates you manually imported, or that were created by an application for your host. This is the closest to a plausible answer, imo.
    - kelnos 14d ago
      > What information from your login keychain do you expect to need on your new computer? Pretty much everything?
- Angostura 15d ago
  Migration assistant can also use a TM backup, I’m pretty sure

ryandrake 15d ago

It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.

GeekyBear 15d ago
> As a general principle, as a user, I expect a file on one computer to be usable on another computer. As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s). > if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. You can export your passwords to a plain text CSV from the original computer.
- ftchd 15d ago
  As a general rule, if I'm the user of both disks I expect to have the encryption key(s).
- shaky-carrousel 15d ago
  As a general rule, I expect a file on an encrypted disk to be encrypted with a key derived from a password I provide.
  - wtallis 15d ago
    I think it's time to update your expectations. Hardware security modules have been around for quite a while. You shouldn't assume that your chosen password is the only input to the key derivation, or even that the raw key itself will always be obtainable.
    - shaky-carrousel 15d ago
      I never assumed that my chosen password was the only input to the key derivation. Just that my chosen password is at least one of the inputs to the key derivation. LUKS has been around for quite a while.

wl 15d ago

It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue. Use iCloud Keychain or don't use Keychain at all.

frizlab 15d ago
Or create a separate keychain db and use that. The encryption is only done for the login keychain.
adastra22 14d ago
I've learned to not trust Apple support on anything. My daughter's Watch screen cracked and we sent it in for a replacement. To setup the replacement though, they requried that she unpair then repair the watch then-and-there. They said she wouldn't lose any data, that it just disconnected it from the phone. Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.