When protecting your SSH keys from potential filesystem-based attacks, which security approach do you rely on?
Securing SSH Keys: Software, Hardware, or Secure Enclave?
Standard SSH keys stored in `~/.ssh/` are vulnerable to any malicious script that gains access to your filesystem. While file permissions provide a basic layer of defense, they cannot prevent an attacker from copying the keys. To combat this, developers are increasingly turning to more robust, hardware-backed security methods. Some users rely on software-based managers like 1Password or Bitwarden, which encrypt keys at rest, though the keys are still decrypted in memory during use. Others prefer physical hardware like the YubiKey 5C to ensure the private key is physically impossible to extract from the device. A newer, native alternative is leveraging the macOS Secure Enclave. By using tools like `sc_auth` and the `ssh-keychain.dylib` provider, developers can create keys that live entirely within the Mac's isolated security subsystem. This approach allows for authentication via Touch ID, ensuring the private key never touches the main processor or disk. Choosing between these methods involves balancing convenience, such as not carrying extra hardware, against the absolute security of external physical devices.
Options
- Software managers (e.g., 1Password or Bitwarden)
- Physical hardware keys (e.g., YubiKey 5C)
- macOS Secure Enclave with Touch ID
- Standard keys with file permissions