> No key files (like ~/.ssh/id_ed25519.pub and friends) littering the file system; and there’s no risk of mistakenly deleting them either.<p>Or backing them up, or copying them to your new computer. You're just one spilled coffee cup away from losing the key.
That was my first thought, too — this might work as one of additional methods of logging in, but not as the only one.<p>I have been using YubiKeys for many years now, following this guide: <a href="https://github.com/drduh/YubiKey-Guide" rel="nofollow">https://github.com/drduh/YubiKey-Guide</a><p>This means I can have secure private keys for ssh and gpg (cue the crowd saying gpg is insecure without offering good modern alternatives), which I can also back up. And I can set up multiple YubiKeys, which I do.<p>An additional advantage of this solution is that you can set your YubiKey to require a touch confirmation before performing an operation. This makes it much harder for runaway AI agents to wreak havoc on your servers: there is a physical limitation, which I really like.
Yes I don't see how that's helpful.<p>It's quite opposite of what I'd want.<p>If you use a trezor hardware wallet (and probably other hardware wallets) you can deterministically regenerate -sk keys.<p>I use trezors various agents for AGE, FIDO2/passkey, ssh[0].<p>But you still need the backup some bits of material like stubs for some FIDO keys (not secret material) that need importing into fresh trezor devices.<p>It's approaching the never lose a key again levels.<p>Of course, I won't pretend there isn't an obvious issue. What if you lose the seed words or someone gains access. What if the software becomes incompatible, or trezor devices become expensive/change etc.<p>[0] <a href="https://github.com/romanz/trezor-agent" rel="nofollow">https://github.com/romanz/trezor-agent</a>
Yes, this only works if you can register more than 1 ssh keys on the services you want.
Which you can do pretty much anywhere already? I'm at least not aware of any major service not allowing you to register multiple SSH public keys.<p>With the obvious exception being, for whatever reason, AWS that only allows specifying ONE SINGLE KEYPAIR when creating new EC2 VMs. Whyyyyyyyyyyyyyy?!
No way, I just wondered if there is a way to do this myself... Having to type in my password was getting tedious for my lazy self.
The version of OpenSSH included with macOS does not support FIDO-related features and instead uses the relevant parameters to access the macOS Keychain, so I always have to install OpenSSH from nixpkgs myself.
Just in case it helps someone, a while ago I wrote a blog post with exact CLI invocations to set up a local-password-store protected by TouchID. If you wish, the encrypted password-store can be backed up and tracked with a Git.<p>> PasswordStore (`pass`) + GnuPG (`gpg`) + TouchID<p>> <a href="https://gurjeet.singh.im/blog/passwordstore+gnupg+touchid" rel="nofollow">https://gurjeet.singh.im/blog/passwordstore+gnupg+touchid</a>
Sounds complicated. Just install <a href="https://secretive.dev/" rel="nofollow">https://secretive.dev/</a>
Crazy that this particular feature we’ve all been waiting for hasn’t received first-party support by any DevEx company.<p>You know, the companies that say security is their number one priority, or companies that scream “developers, developers, developers”. How Google and Apple didn’t come up with something together eludes me, but then again, we have entire ecosystems and categories deployed in the areas they don’t service (auth, application control, etc).
If you do this, have at least one backup key (if need be on paper) or a guaranteed alternate path into the hosts you depend on this key to access. Because if the secure enclave is as good as we're told, if you lose access to ->THIS<- secure enclave, its game over for the keys.<p>Secure enclave protecting Keychain, the keychain is backed up. Not the contents of the enclave.<p>Too many failed access attempts? <i>poof</i> the key is gone. Could be as low as 10.<p>(happy to be corrected. This is what I gather from a quick read-around. I was a bit surprised the site didn't seem to discuss this)
Your backup key should also be in a secure enclave, just in a different secure enclave. Both keys should be accepted by the system.<p>The truly paranoid can multiple <i>types</i> of secure enclaves - TouchID for primary, a YubiKey for backup.<p>> If need be on paper<p>Your security is only as strong as its weakest link. Paper has a way of getting photographed, and the privacy of your key depends on your OCR software, unless you really want to painstakingly copy it in by hand, and even then, it turns into a file-based key on the filesystem, with all its attendant risks.
No, paper for cold storage has the advantage of requiring physical access. Not some virus or hacker breaking into your computer from hundreds of miles away. If you are living in the US, gun ownership provides additional security over this piece of paper at home.
As cool as this is, this does limit the functionality of your keys, because not everything can access the secure enclave in the way it wants to - and as others point out, this is a one-way street and locks your mac hardware into the flow.<p>I went with this system for some months but it ultimately broke my workflow. I switched to a system of my own devising, in which my local security key decrypts the SSH keys I require.
happy 1Password user since years, provides this too and you'll have you ssh keys in the 1P keychain (yes, not open source, I know - only flaw imho)
That would make it extractable and syncable to other hosts. That's fine if that's what you want but it's an important distinction.
I am doing the same, such a great underrated feature that many people do not know of.
[flagged]
[dead]