| ▲ | Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe(derflounder.wordpress.com) |
| 27 points by zdw 18 hours ago | 13 comments |
| |
|
| ▲ | dfabulich 19 minutes ago | parent | next [-] |
| Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed? |
|
| ▲ | shenenee an hour ago | parent | prev | next [-] |
| This is pretty much how it's suppose to work... |
| |
| ▲ | winstonwinston an hour ago | parent | next [-] | | Maybe but this is unexpected if you need to restore from a backup.. | | |
| ▲ | ryandrake 5 minutes ago | parent | next [-] | | It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird. | |
| ▲ | petronic 28 minutes ago | parent | prev | next [-] | | I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration. | | |
| ▲ | winstonwinston 15 minutes ago | parent [-] | | But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored. |
| |
| ▲ | __MatrixMan__ 29 minutes ago | parent | prev [-] | | Don't backup keys, rotate them. | | |
| ▲ | gavinsyancey 11 minutes ago | parent [-] | | I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless. |
|
| |
| ▲ | Retr0id an hour ago | parent | prev [-] | | I'm more interested by the fact that it apparently didn't work this way before Tahoe. | | |
| ▲ | pram an hour ago | parent [-] | | IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default. |
|
|
|
| ▲ | flyingshelf 7 minutes ago | parent | prev | next [-] |
| And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something. |
| |
| ▲ | ImPostingOnHN 5 minutes ago | parent [-] | | that seems reasonable, as it is the lowest common denominator for interoperability what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't allowed to use their own property to export something different |
|
|
| ▲ | cute_boi 24 minutes ago | parent | prev [-] |
| This is good. |
