The discussion centers on the trade-offs between using macOS Secure Enclave for SSH keys versus traditional methods, with users praising the hardware-bound security but criticizing the lack of portability and backup capabilities. Strong disagreements arise regarding whether the biometric requirement is a feature or a bug for automation, and if the perceived security benefits outweigh the usability friction compared to passphrase-protected keys.
139 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4maxgoedjen
secretive
Swift2020–2026
maxgoedjen / secretive
secretive
Protect your SSH keys with your Mac's Secure Enclave
34Distinct people
43Mentions
1Explicit recommenders
9.4KGitHub stars
What to know before exploring
What it is
Protect your SSH keys with your Mac's Secure Enclave
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
> Wouldn't having multiple competing open source window managers be considered a good thing? I absolutely love this about Linux. However, I think this freedom of choice leads…
heywoodlh used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
Mentions over time
HN mentions by year43 dated mentions
Observed mentions: 2020-06-27 19:46:30 UTC to 2026-10-20 16:09:10 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 13 | 0 | 13 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 3 | 0 | 3 |
What Hacker News says
43 sourcesCOcolesantiago·Oct 20, 2026
Or you could just use Secretive. https://github.com/maxgoedjen/secretive
In SSH Keys on macOS with Touch ID> The goal of the lander is to get you to use the clubhouse. Not get you to become a contributor, or intrigued/turned away by their stack choice.
Yep! That’s the idea. When writing, think about what your users want to know. If there is some technical detail you want to clarify – show how it helps the user.
> use the same key across devices!
That’s easier for sure! But if I lose a device, revoking one key on every server/service is a PITA already, and reissuing and replacing it on every server and client is even more so. (Also, this wouldn’t work with HSM-backed key stores like https://github.com/maxgoedjen/secretive :-)
In Late.sh – a command-line Clubhouse for computer peopleI'm not a huge fan of 1Password, there have been way too many issues in the past with it. If you're on a Mac, I can highly recommend you to check out Secretive https://github.com/maxgoedjen/secretive
In Postmortem: TanStack NPM supply-chain compromiseYou can generate and store your private SSH key in the secure enclave, there's even an SSH agent that does that for you: https://github.com/maxgoedjen/secretive
But that's it.
Anything more complicated is not possible. You can't even upload your existing key into the SE.
In Apple: SSH and FileVaultYou have an option to keep your SSH key in the Secure Enclave behind TouchID or YubiKey
https://github.com/maxgoedjen/secretive
In Is it possible to allow sideloading and keep users safe?I know I’m asking for too much, but.
The macOS app Secretive [1] stores SSH keys in the Secure Enclave. To make it work, they’ve selected an algorithm supported by the SE, namely ecdsa-sha2-nistp256.
I don’t think SE supports PQ algorithms, but would it be possible to use a “hybrid key” with a combined algorithm like mlkem768×ecdsa-sha2-nistp256, in a way that the ECDSA part is performed by the SE?
[1]: https://github.com/maxgoedjen/secretive
In OpenSSH Post-Quantum CryptographyHardware protection for your private keys
1 points · Open discussionAgreed, because VSCode does not provide an SSH Agent but does communicate with your local one (their own version of ForwardAgent, complete with the security implications that carries). And the way it does that breaks a popular macOS SSH agent: https://github.com/maxgoedjen/secretive/issues/543
In VSCode’s SSH agent is bananasSecretive: macOS app for storing SSH keys in the Secure Enclave
3 points · Open discussionI just tried 1Password and it refused to start not being in `/Applications`. I've seen this happen with one other app (Secretive), although it doesn't quite refuse to run. I can't remember all the details, but I think it has to do with a limitation in newer versions of macOS, where apps that try to register launchd services can only do so if they live in /Applications rather than ~/Applications. The problem with launching those background services from binaries that live in ~/Applications disappears if you disable SIP. When I first encountered it, it made me wonder if ~/Applications is not really supported on modern macOS. I wish I could find the issue for that but I didn't, when I looked just now. :-\
Oh, here's that issue: https://github.com/maxgoedjen/secretive/issues/77
1Password definitely acts weird for me, to where I kind of wonder
Read the rest
if the .app folder is malformed somehow. The version installed in the Nix store actually works fine-- but not if I double-click it or open it with the `open` command. In that case it kinda acts like something is going to launch but then it never comes up. But if I manually invoke `/Applications/Nix\ Apps/1Password.app/Contents/MacOS/1Password` from my terminal, it starts up fine! But when I directly launch that executable from Finder, the application does not start and I see that same message about not living in /Applications printed in the terminal. Idk why 1Password refuses to run from anywhere other than /Applications but that seems to be it's message rather than the operating system's.
It's a shame 1Password's Mac app can't run from the Nix store. They clearly have at least one Nixer at the company because they have cool integrations like this:
https://developer.1password.com/docs/cli/shell-plugins/nix/
I couldn't even get the Docker Desktop package to build from `brew-nix`. OrbStack in the Nix store died on signature errors, but when I visited Security & Privacy in System Preferences after that, there was a little notice that OrbStack had been blocked from running because it was from an unrecognized developer, with the option to allow it. After being allowed, it seemed to work as normal. Same for Podman Desktop.
Why do the signatures for those apps end up getting replaced with this setup anyway?
* Homebrew - Package manager (kinda like apt/rpm on Linux).
* Secretive - Stores SSH keys in the secure enclave [https://github.com/maxgoedjen/secretive]
* Alfred - Better spotlight [https://www.alfredapp.com/]
* Hazel - File automations [https://www.noodlesoft.com/]
* Arq - Excellent backup software for local and/or remote backups [https://arqbackup.com/]
* ChronoSync - File synchronization on steoroids [https://www.econtechnologies.com/chronosync/overview.html]
* Launch Control - Easily edit and control those Launchctl files [https://www.soma-zone.com/LaunchControl/]
* Sublime Text - Excellent and fast text editor [https://www.sublimetext.com/]
* Sublime Merge - Excellent Git UI [https://www.sublimemerge.com/]
* Zed - Currently evaluating if it can replace Sublime Text [https://zed.dev/]
* Little Snitch - Network Monitor and Application
Read the rest
Firewall [https://obdev.at/products/littlesnitch/index.html]
* KnockKnock/BlockBlock/Oversight - Various malware monitoring and detection [https://objective-see.org/index.html]
* Draw.io - Diagramming tool [https://www.drawio.com/]
* Iterm2 - Terminal Replacement [https://iterm2.com/]
I use a bunch of other apps, but the above are probably the most broadly applicable :)
The Secretive SSH Agent uses it to store SSH keys: https://github.com/maxgoedjen/secretive
In Apple to Debut 'Passwords' App, in Competition with 1Password, LastPassI use both PKCS#11 and OpenPGP SSH keys and in my opinion, PKCS#11 is a better user experience if you don't also require PGP functionality. Especially if you're supporting MaxOS clients as you can just use Secretive[0]. As you say, FIDO is even better but comes with limitations on both client and server, which makes life tough.
[0] https://github.com/maxgoedjen/secretive
In OpenSSH introduces options to penalize undesirable behaviorAs far as I know, that’s correct. macOS never sees any of the fingerprint data, and thus it can’t be read or intercepted easily.
The Secure Enclave can also store various keys, which apps like Secretive[0] can use to store and gate access to things like SSH keys with. Feels a little nicer than letting them rattle around loose in ~/.ssh/ where any passerby can pick them up, is more convenient than an a USB key, and lets me know when something is trying to use it by way of unexpected Touch ID prompt. It’s a feature I miss when using my Windows/Linux laptop.
[0]: https://github.com/maxgoedjen/secretive
In Ovid's myths of macOS: password entry dialogs and the death of SemeleFor Macs: https://github.com/maxgoedjen/secretive
In SSH keys stolen by stream of malicious PyPI and NPM packagesShowing the 15 most recent of 43 sources. Enable JavaScript to search and browse every indexed mention.