If you do this, have at least one backup key (if need be on paper) or a guaranteed alternate path into the hosts you depend on this key to access. Because if the secure enclave is as good as we're told, if you lose access to ->THIS<- secure enclave, its game over for the keys.

Secure enclave protecting Keychain, the keychain is backed up. Not the contents of the enclave.

Too many failed access attempts? poof the key is gone. Could be as low as 10.

(happy to be corrected. This is what I gather from a quick read-around. I was a bit surprised the site didn't seem to discuss this)

▲

solatic 4 hours ago | parent [-]

Your backup key should also be in a secure enclave, just in a different secure enclave. Both keys should be accepted by the system.

The truly paranoid can multiple types of secure enclaves - TouchID for primary, a YubiKey for backup.

> If need be on paper

Your security is only as strong as its weakest link. Paper has a way of getting photographed, and the privacy of your key depends on your OCR software, unless you really want to painstakingly copy it in by hand, and even then, it turns into a file-based key on the filesystem, with all its attendant risks.

▲

littlecranky67 3 hours ago | parent [-]

No, paper for cold storage has the advantage of requiring physical access. Not some virus or hacker breaking into your computer from hundreds of miles away. If you are living in the US, gun ownership provides additional security over this piece of paper at home.

	▲	gmac 3 hours ago \| parent [-]
		Right, because shooting someone for the sake of a piece of paper is usually a proportionate response …