Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secretive – macOS native app to store SSH keys in the Secure Enclave

github.com

Post reply on HN
Print view View original

101–109 of 109 posts

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#101

Post by kitsunesoba »

threentaway wrote: post #87
metafunctor wrote: post #72

Earlier quoted context omitted.

Yep, it’s so much better than just key files: keeps key material in a secure system (Secure Enclave), you know when a key is used (standard macOS security prompt), and requires a physical interaction (Touch ID) to use a key.

So, a non-portable YubiKey?

More like a built-in YubiKey. It's a convenience. When using one's MacBook, you don't need to pull your YubiKey out of your bag/drawer/etc to authenticate, and if you're traveling you can just leave YubiKey at home/the office, giving you one less thing to lose.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#102

Post by corty »

Xylakant wrote: post #92
namibj wrote: post #74

Earlier quoted context omitted.

Also, there are arguments against generating RSA keys with closed-source software (don't tell me that's all pure hardware in a smartcard). For one, generating keys that are vulnerable to something exotic is very much a viable threat, and yubikeys in particular had an issue where some accidentally created very weak keys. Sure, you need to make sure the key doesn't leak on it's way, but that's not really the issue.

> and yubikeys in particular had an issue where some accidentally created very weak keys. So did Debian between 2006 and 2008 https://certlogik.com/debian-weak-key-check/

Yes, but software is easier to fix and the problem is easier and more probable to find.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#104

Post by cynix »

judge2020 wrote: post #90
cynix wrote: post #55

Earlier quoted context omitted.

Been using this since the beginning and it’s great. However, there has been no updates ever since they were acquired by Akamai. A bit worried it’ll suddenly stop working one day...

Thankfully (i believe) everything that goes into it is open source https://github.com/kryptco

The code may be open source, but not everyone can compile and install the iOS app easily, or have the required infrastructure that allows the push notification to happen.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#105

Post by Hnrobert42 »

mfontani wrote: post #85
Hnrobert42 wrote: post #83

Earlier quoted context omitted.

There is a native way in .ssh/config. I just added a reply to a different post.

That only restricts the blast radius to one key. One is unawares of when, how, and for what purposes that key is used - as forwarding the key means it's available for use by any user process (as the mechanism behind the forwarding is user-owned) or root (as root can see everything). Touch-to-authorize helps mitigate that. If one seees the prompt come up when they've just performed a git pull, it's expected and likely…

You are correct. Touch to authorize is lower risk. I don’t know a way to do that natively. Sorry if I misunderstood.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#106

Post by john_alan »

ashildr wrote: post #99
john_alan wrote: post #70

Cool but the enclave only supports the secp256r1 curve, whose coefficients are NSA chosen.

While I don‘t think that this is relevant for my personal thread scenarios, I think that this is unfortunate at least and Apple should change it with new hardware.

Ya problem is it’s all NIST “approved” and US companies love that because it means the government is happy to use their products.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#107

Post by miguelmota »

stavros wrote: post #95
miguelmota wrote: post #73

I've been using a YubiKey device for SSH using yubikey-agent [0] and it's been great since it’s not possible to extract keys from hardware keys and the device is carried with me. The agent is also integrated with pinentry so it requires a pin code for the session. [0] https://github.com/FiloSottile/yubikey-agent

You don't even need the agent with the latest SSH versions, SSH can now use U2F natively, which is wonderful.

Oh cool didn't not know that. That’s awesome.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#108

Post by namibj »

Xylakant wrote: post #92
namibj wrote: post #74

Earlier quoted context omitted.

Also, there are arguments against generating RSA keys with closed-source software (don't tell me that's all pure hardware in a smartcard). For one, generating keys that are vulnerable to something exotic is very much a viable threat, and yubikeys in particular had an issue where some accidentally created very weak keys. Sure, you need to make sure the key doesn't leak on it's way, but that's not really the issue.

> and yubikeys in particular had an issue where some accidentally created very weak keys. So did Debian between 2006 and 2008 https://certlogik.com/debian-weak-key-check/

In OpenSSL. Not in GnuPG. I'm not claiming the latter necessarily has better code, but the former's bad code quality is known.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#109

Post by namibj »

corty wrote: post #102
Xylakant wrote: post #92

Earlier quoted context omitted.

> and yubikeys in particular had an issue where some accidentally created very weak keys. So did Debian between 2006 and 2008 https://certlogik.com/debian-weak-key-check/

Yes, but software is easier to fix and the problem is easier and more probable to find.

More importantly: you can check the key generator to not include a Dual_EC_DRBG.
Post reply on HN