1

Recently I had a long time mitigating possible risks occured due to malware I got on my Mac. Now I wiped the system and trying to figure out how to set up it in such way that when similar situation happens I won't worry about sensitive information being stolen.

So, my primarily concern right now is access to SSH keys. Currently I have my keys generated with passphrases, so if somebody gets access to my filesystem he won't be able to do anything with the key files. But, as I see, a very common solution is to store passphrases for those keys in Keychain.

I have added passphrases for my SSH keys to Keychain and now it seems that I don't need to enter login password nor passphrase when keys are being used.

Am I correct that while passphrases are stored in Keychain, anybody who was access to my shell is able to use them without being asked for passphrase, and, if so, why is such insecure solution is so widely recommended to be used?

1 Answer 1

1

I am not aware that this setup is widely recommended. It is not the default setup provided by Apple, so it is something you must explicitly configure yourself.

And yes, if your system is set up so that you can log in from your computer without supplying a passphrase, then others who have access to your computer can do the same.

Note that any program cannot just get the passphrase from the Keychain. The Keychain must be opened first. This means that you must be logged on to the computer - i.e. you must know your user account password (or what you use to authenticate with your account). You cannot just login as a guest and then extract your keys from the keychain, nor can programs running in a different context just access your keychain.

In order to get a more secure setup, it is advisable to configure your system so that you need to authenticate each time - for example biometrically. I.e. if you set it up so that you need to use Touch-ID every time something needs to grab the information from Keychain - that's a good idea.

An easy way to get a setup like this is to use third-party software such as 1Password. You can find their guide for such a setup at 1Password SSH agent.

An even better idea is not to store passphrases for keys in the Secure Enclave. Instead generate the keys themselves in the Secure Enclave, so that it can perform cryptographic operations on your behalf without ever revealing the private key.

An easy way to set up this is to use the free and open-source software Secretive.

A convenient way to get keys generated on a secure element, that is not tied to that specific computer, is to use a YubiKey or an equivalent product.

8
  • I was surprised because GitHub recommends this solution (docs.github.com/en/authentication/connecting-to-github-with-ssh/…) without mentioning that it may be not the best thing to do Commented Oct 28, 2023 at 14:24
  • Do you have any sources which are explaining how I can set up ssh-keys with Keychain in a way that I will be able to unlock them via Touch ID? Commented Oct 28, 2023 at 14:25
  • Well, in defense of GitHub: it’s not the best thing to do, but it’s definitely not the worst thing either. It is considerably better than not using keys at all, or using a key without a passphrase. The convenience of this option could convince some to choose a better option than what they would have done. Also note that GitHub on the same page has instructions for when you have a hardware security key (such as the YubiKey I mentioned in my answer).
    – jksoegaard
    Commented Oct 28, 2023 at 20:58
  • @ArseniyKulikov I have added explanation on how to setup this in an easy, "graphical user interface only" way. In your case, I would start by looking at the "Secretive" app.
    – jksoegaard
    Commented Oct 29, 2023 at 9:56
  • Thank you! But Secretive app is not able to work with keys generated externally and seem to not support key exporting. This is not really convenient :( Commented Oct 29, 2023 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .