Your Mac Can Hold an SSH Key That Can't Be Stolen
Setting Up SSH Keys on macOS with Touch ID
A quick three-command setup turns the Secure Enclave on any modern Mac into an SSH authenticator: create a non-extractable P-256 identity with sc_auth, register it through ssh-keychain.dylib, and add the public key to GitHub. Touch ID fires on every git push, and the private key never exists as a file. The post also digs into the undocumented CryptoTokenKit plumbing underneath.
No one can steal your identity (well, you can't even give it away willingly since it can't be extracted from the Secure Enclave), but with great powers etc: if your Mac dies, so does the identity, and you'll need to create a new one.
- maratc
> No key files (like ~/.ssh/id_ed25519.pub and friends) littering the file system; and there’s no risk of mistakenly deleting them either.
Or backing them up, or copying them to your new computer. You're just one spilled coffee cup away from losing the key.
- citrin_ru
If I knew it's relatively easy I would have saved $$ on yubikey - for personal projects security requirements are not high but it's good to have something better than a file which could be stolen by malware. Kudos to author for the how-to.
- QGQBGdeZREunxLe
Sounds complicated. Just install https://secretive.dev/
- apimade
Crazy that this particular feature we’ve all been waiting for hasn’t received first-party support by any DevEx company.
You know, the companies that say security is their number one priority, or companies that scream “developers, developers, developers”. How Google and Apple didn’t come up with something together eludes me, but then again, we have entire ecosystems and categories deployed in the areas they don’t service (auth, application control, etc).
- gurjeet
Just in case it helps someone, a while ago I wrote a blog post with exact CLI invocations to set up a local-password-store protected by TouchID. If you wish, the encrypted password-store can be backed up and tracked with a Git.
> PasswordStore (`pass`) + GnuPG (`gpg`) + TouchID