Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Touch, Stronger SSH

ubicloud.com

Post reply on HN
Print view View original

1–10 of 53 posts

Re: Hardware Touch, Stronger SSH

#4

Post by XiS »

antonkochubey wrote: post #3

On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721 It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.

Been using ed25519-sk with Yubikey for a few years now. Key is stored in KeepassXC and loaded in my SSH agent upon unlock.

It makes my SSH key pretty portable across devices

Re: Hardware Touch, Stronger SSH

#5

Post by sebazzz »

SSH using GPG Yubikeys and git signing using GPG was quite a process to set up on Windows a few years ago. Not something I'd want or know how to repeat. Hopefully things have improved in the mean time.

Re: Hardware Touch, Stronger SSH

#6

Post by Almondsetat »

antonkochubey wrote: post #3

On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721 It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.

You can also do something similar with any computer that has a TPM. It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly

Re: Hardware Touch, Stronger SSH

#7

Post by simon04 »

Using a Token2 based id_ed25519_sk_rk key, I found very helpful to configure a different `pushurl` in `.git/config`. This allows to pull via HTTPS w/o a hardware touch.

    [remote "origin"]
            url = https://github.com/freeCodeCamp/devdocs.git
            pushurl = git@github.com:freeCodeCamp/devdocs.git

Re: Hardware Touch, Stronger SSH

#8

Post by Foxboron »

Almondsetat wrote: post #6
antonkochubey wrote: post #3

On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721 It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.

You can also do something similar with any computer that has a TPM. It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly

> It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly

This is my cue.

https://github.com/Foxboron/ssh-tpm-agent

Re: Hardware Touch, Stronger SSH

#9

Post by Sublevel5169 »

Foxboron wrote: post #8
Almondsetat wrote: post #6

Earlier quoted context omitted.

You can also do something similar with any computer that has a TPM. It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly

> It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly This is my cue. https://github.com/Foxboron/ssh-tpm-agent

Thank you for sharing!

Re: Hardware Touch, Stronger SSH

#10

Post by throwawayqqq11 »

XiS wrote: post #4
antonkochubey wrote: post #3

On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721 It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.

Been using ed25519-sk with Yubikey for a few years now. Key is stored in KeepassXC and loaded in my SSH agent upon unlock. It makes my SSH key pretty portable across devices

My approach aswell. Lock down ssh-agent and restrict its usage as much as possible. Securing your keys is also very reasonable but it cant silence this naging voice in the back of my head that keeps reminding me of a compromised ssh-agent or shell, whenever i authorize privileged actions.
Post reply on HN