Secure Enclave is still more secure in that it should be impossible to access the private key. Password protected keys are still vulnerable to malware that can read the keyboard, trick you in to typing the password, or that have exploits in macOS to read the memory.
replyIsn’t the macOS keychain user-readable by default?
replyAssuming the attacker has user rights (which it needs to read the key) it could also read the passphrase, right?
Update: I tried it out and stand corrected. ssh-add doesn’t store it in the user-readable keychain. So the passphrase is protected. (And also not recoverable by the user).
Key on disk plus a passphrase is still only 1FA. Key in the SE + an unseal PIN is 2FA. There's already plenty written about why one is better better than the other.
replyDo you type your passphrase every time you log into a remote machine? If not, the private key is in RAM and can be extracted by malware and stolen. If so, that's way more annoying than using touchid or some other physical proof of presence.
replyI used to install ssh_locker [1] (I don’t know if it still works), and have the passphrase in a keychain separate from the default `login` that I then set in Keychain Access to autolock after a set period of time. Handy for keeping the private key for a while in RAM and then autoremoved, instead of having it there for the whole session. It worked transparently and is a feature that should come with the OS.
replyChatGPT says ssh_locker locked the keys with `ssh-add -x` which doesn’t necessarily remove them from RAM. Duh! It does point to suggested minimal changes to its source code to effectively accomplish that though.
replywas wondering the exact same thing. dude never heard of passphrases?
reply