sekey

Ah, I see that Secretive is a victim of feature creep. I think it still can use the SE to store the private key, but it also has more ways to do it. This is the initial inspiration for Secretive: https://github.com/sekey/sekey - it uses the SE to generate and store the actual private key, so it never leaves the machine. Hence its limitations.

I've been using https://github.com/sekey/sekey for years now! It handles gpg as well

> relaying auth requests to your phone for approval and storing secrets in the Secure Enclave Like the acquired/abandoned https://github.com/kryptco/kr [key stored in a [...] mobile app] with iOS and Android apps all under an "All Rights Reserved"-source license? Also, newer Macs have a Secure Enclave (supports 256-bit secp256r1 ECC keys): https://github.com/maxgoedjen/secretive [storing and managing SSH keys in the Secure Enclave [...] or a Smart Card (such as a YubiKey)] https://github.com/sekey/sekey [Use Touch ID / Secure Enclave for SSH Authentication!]

There's also this to use a key in the Secure Enclave and Touch ID to confirm authentication: https://github.com/sekey/sekey

Use sekey: https://github.com/sekey/sekey

Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https://github.com/sekey/sekey)

I try to use Touch ID for everything it can be used for. Touch ID for sudo http://osxdaily.com/2017/11/22/use-touch-id-sudo-mac/ Touch ID for SSH https://github.com/sekey/sekey (uses secure enclave) I use this for 2FA https://krypt.co/ (uses secure enclave on your phone) Touch ID for password management https://1password.com/ I upload dotfiles and other credentials in a keybase encrypted repo

If you have a newer MacBook with TouchID, you can get similar benefits using https://github.com/sekey/sekey. Arguably better, because access is backed by biometrics (TouchID) so it's "something you are" (fingperint) + "something you have" (laptop) and quite a bit simpler than setting up GPG backend SSH keys.

I'm amazed this is so complicated. I recently used https://github.com/sekey/sekey to set up SSH with TouchID on a mac, and was really surprised how simple it was.

If you own a MacBook Pro with Touch Id I highly recommend https://github.com/sekey/sekey. It generates ssh keys in the secure enclave (mini HSM chip) and allows you to login to remote machines with Touch Id. The key can never leave the secure enclave.

If you have a recent MacBook, use https://github.com/ntrippar/sekey for SSH keys. Private key is stored in the built-in HSM (Secure Enclave) and access is controlled by biometrics (TouchID). You can do the same with a Yubikey, but it’s not quite as good because a) you can lose your Yubikey easily and b) there’s no biometrics. Private keys stored on filesystems is an antipattern.

Or if you have a Touch Bar MacBook: https://github.com/ntrippar/sekey