Secretive – macOS native app to store SSH keys in the Secure Enclave

Post by cma » Sun, Jun 28, 2020, 5:08 AM UTC

fhqghds wrote: post #69

XMPPwocky wrote: post #49

Earlier quoted context omitted.

To be clear, that would be a privacy issue (a malicious server could tell what keys you have), but wouldn't allow a malicious server to log in to anything else with your keys. You don't send the private key when you log in.

Note that GP said -A -- this means the agent gets forwarded, and processes on the malicious server can ask the agent to perform authentication operations. Touch to auth means the agent (or hardware token) asks the user to to confirm they are expecting an authentication request to come in. This allows you to forward your agent to a host and have slightly more protection against malicious processes on the host using yo…

Post by miguelmota » Sun, Jun 28, 2020, 5:33 AM UTC

Post by _23sd » Sun, Jun 28, 2020, 6:07 AM UTC

old-gregg wrote: post #65

For the love of God, please stop using SSH keys. Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials. Use auto-expiring certificates that are issued after a proper SSO+2FA flow: https://gravitational.com/blog/how-to-ssh-properly/

Post by kortilla » Sun, Jun 28, 2020, 6:30 AM UTC

fragmede wrote: post #62

Metus wrote: post #48

Earlier quoted context omitted.

After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird . Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wro…

> which makes them less secure than the passwords for websites managed by the exact same keychain That's NOT true. While giving out less information to untrusted parties is obviously better than more, the private key itself is not transmitted directly to the server. This means that connecting to an attacker's SSH server doesn't give them a copy of your private key, so they can't then connect to your SSH servers.

Post by kortilla » Sun, Jun 28, 2020, 6:36 AM UTC

_23sd wrote: post #75

old-gregg wrote: post #65

For the love of God, please stop using SSH keys. Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials. Use auto-expiring certificates that are issued after a proper SSO+2FA flow: https://gravitational.com/blog/how-to-ssh-properly/

> Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials. I don’t think that’s anywhere close to true but I’d be interested if you have reason to believe it is or some examples. Or maybe it’s intentional hyperbole?