Does anyone know of a way to guard rclone passwords that would be stored in rclone.conf? Is it possible to leverage the keychain or this tool for this? Typically passwords for sftp logins are stored with a reversible hash (see `rclone reveal`), which isn't ideal.
Secretive – macOS native app to store SSH keys in the Secure Enclave
61–70 of 109 posts
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#62Earlier quoted context omitted.
Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…
After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird . Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wro…
> which makes them less secure than the passwords for websites managed by the exact same keychain
That's NOT true. While giving out less information to untrusted parties is obviously better than more, the private key itself is not transmitted directly to the server. This means that connecting to an attacker's SSH server doesn't give them a copy of your private key, so they can't then connect to your SSH servers.
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#63Earlier quoted context omitted.
Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage
I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?
"Drive" is probably the best option
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#64Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.
There is an API to store custom keys in the Secure Enclave. It only supports 256-bit ECC keys and the private keys cannot be read or written, only operated on by the Enclave itself.
There is no official storage limit, it seems, but one Stack Overflow answer put the number at around 400. Interestingly, there appears to be no quota system for preventing one app from using them all.
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#65For the love of God, please stop using SSH keys. Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials.
Use auto-expiring certificates that are issued after a proper SSO+2FA flow:
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#66Is is possible to recreate this using Windows Hello and TPM?
hmm, interesting question. should be. Windows Hello generates RSA keypairs I think.
Can you just use those as SSH keys ? The OS will take care of securing them in TPM if available.
If you wanted to use conventional file-based keypairs and secure the "passphrase" instead, maybe use the Hello private key to encrypt the passphrase into the credential store ? I am not up-to-date on whether there's a newer more secure way to store credentials, but seems like forcing a Windows Hello action to decrypt the data in the store should be sufficient.
I could be missing something though. Otherwise you'd think there'd be a solution from Microsoft already.
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#67Nice to see this going mainstream after only
checks almanac
... a quarter-century of standards and practices.
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#68Earlier quoted context omitted.
Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…
After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird . Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wro…
[deleted]
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#69Earlier quoted context omitted.
Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…
To be clear, that would be a privacy issue (a malicious server could tell what keys you have), but wouldn't allow a malicious server to log in to anything else with your keys. You don't send the private key when you log in.
Note that GP said -A -- this means the agent gets forwarded, and processes on the malicious server can ask the agent to perform authentication operations.
Touch to auth means the agent (or hardware token) asks the user to to confirm they are expecting an authentication request to come in.
This allows you to forward your agent to a host and have slightly more protection against malicious processes on the host using your key.
Re: Secretive – macOS native app to store SSH keys in the Secure Enclave
#70Cool but the enclave only supports the secp256r1 curve, whose coefficients are NSA chosen.